Created
January 31, 2013 12:52
-
-
Save bonsaiviking/4682644 to your computer and use it in GitHub Desktop.
Finding headless shells
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/perl -an | |
# One-liner version: | |
# lsof -d txt,0,1,2 | perl -anE'push@g,$F[1]if$F[4]eq"CHR"and$F[8]=~/^.dev.[pt]t[sy]/;$t{$F[1]}=$_ if$F[3]eq"txt"and$F[8]=~/^.(usr.)?bin.((b|d)?a|z|k|c|tc)*sh/;END{delete$t{$_}for@g;say values%t}' | |
# store the PID of processes that use a PTY/TTY for STDIN, STDOUT, or STDERR | |
push @g, $F[1] if $F[4] eq "CHR" and $F[8]=~/^.dev.[pt]t[sy]/; | |
# Store the whole line if the txt file descriptor is a shell | |
$t{$F[1]}=$_ if $F[3] eq "txt" and $F[8]=~/^.(usr.)?bin.((b|d)?a|z|k|c|tc)*sh/; | |
END { | |
# clear out the PIDs that use a pty/tty | |
delete $t{$_} for @g; | |
# and print what's left | |
say values %t; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment