38

I want to download a script from: http://dl.dropbox.com/u/11210438/flockonus-stack.sh and execute it. My guess is, to use wget renaming it, chmod it, and execute.

What are the commands for doing that on Ubuntu?

7 Answers 7

66

Careful

Before running the script, do you trust the person who wrote it?

For example, did you expect the script to contain this?

echo "brain1" > /etc/hostname

That will try to change your hostname.


For future reference, if, after verifying the script is correct and not malicious, you can run it in one line like this:

wget -O - http://dl.dropbox.com/u/11210438/flockonus-stack.sh | bash

But download it separately and read it before running it the first time.

Also note that interactive prompts inside the downloaded script may not work properly using this method.

6
  • 12
    +1 for pointing out the (significant) security concerns with this. Be absolutely certain you trust the source. That echo "brain1" > /etc/hostname could just as easily be rm -rf /. Jan 24, 2011 at 22:18
  • 2
    +1 Thanks guys, that script is from me, it is safe.. Loved the one-liner, but, it has some interactive lines that didn't run.. dunno why? Jan 24, 2011 at 22:25
  • 1
    Your apt-get install lines? If apt-get would install any extra dependencies, it will ask you, and if it can't it will just exit to be safe. Either add all the dependent packages to the command line arguments, or consider adding -y, e.g. apt-get -y install...
    – Mikel
    Jan 24, 2011 at 22:30
  • the issue is not related to dependencies, it has to do with apt flushing stdin.
    – Zoredache
    Jan 24, 2011 at 23:31
  • 1
    You actually can't trust the source even if you do "trust the source" because of man in the middle attacks. That said, random private urls with bash scripts should be a narrow enough attack vector that nobody with the capability to pull it off cares enough to do it.
    – SpamapS
    Jan 26, 2011 at 9:51
24

Non-Interactive Scripts

wget -O - http://website.com/my-script.sh | bash

Note that when using this method, interactive scripts will not work.


Interactive Scripts

In order to get interactive scripts working, you can use this:

bash <(wget -qO- http://website.com/my-script.sh)

Interactive Scripts that need to be run as root

Warning: This is extremely dangerous. Not recommended.

sudo su -c "bash <(wget -qO- http://website.com/my-script.sh)" root

Note that you cannot simple use sudo bash since using <(...) will create a virtual file and it's file descriptor will not be accessible from roots bash instance. It must be executed on the same user that needs to read the virtual file, so it has to be sent as it's own command inside the root users shell.

1
  • 3
    This is the best answer. It covers the important aspects of interactive vs non-interactive vs privileged execution. Mar 13, 2019 at 19:05
6

That script is from me, it is safe.. Loved the one-liner, but, it has some interactive lines that didn't run.. dunno why?

When dpkg runs, called by apt-get, it flushes stdin. If you are using a command like curl blah | bash, then you are basically sending contents of the page to bash via STDIN. If one of your commands is apt-get, then runs, everything else will be flushed.

The trick is to use a command like this apt-get install --yes denyhosts </dev/null. This gives apt-get a different input, and it simply flushes /dev/null instead of the rest of your script.

If you want to see a complete example of installing something via a remote script you may want to look at this script for setting up denyhosts

For the record, I prefer curl over wget for this, but wget should also be fine.

1
4
#!/bin/sh
if [ ! -f "/tmp/flockonus-stack.sh" ]
then
    wget -O /tmp/flockonus-stack.sh http://dl.dropbox.com/u/11210438/flockonus-stack.sh
fi

sh /tmp/flockonus-stack.sh
4

All of these examples are missing a fairly important point. If you use the url http://dl.dropbox.com/u/11210438/flockonus-stack.sh, you need to audit the script every time you download it, because it can be modified by anyone on the network path between you and dropbox. If you switch to https://dl.dropbox.com/u/11210438/flockonus-stack.sh, you won't have that source of insecurity.

(Dropbox tries to redirect the http URL to https, but in the case of a network attack wget would never get to speak to the real dropbox, and would never see the redirect)

1
  • 2
    This is probably better left as a comment on the question, not an answer, as it doesn't exactly answer the question. Still worth pointing out for sure!
    – Bill Weiss
    May 5, 2016 at 1:07
2

Try simply downloading it as you have specified with wget and then executing it directly. You can get fancy and use variables for the script you want to download etc, but this will do the trick

For example:

!#/bin/bash

#Change to temp directory
cd /tmp

#Download file using wget
wget http://dl.dropbox.com/u/11210438/flockonus-stack.sh

#Execute the file

sh flockonus-stack.sh
1
  • How would I tell my system to actually do this on startup? Jun 16, 2019 at 9:11
1

OK so what happens if the link is bad? Try defining a function that takes care of such eventualities.

netbash(){ if [[ "$(wget -S --spider $1 2>&1 | grep 'HTTP/1.1 200 OK')" ]] && [ ! "$1" == "" ]; then bash <(wget -qO- http://server/$1);else echo "No such file.";fi; }

You could also read the script first and choose before execution if you are paranoid.

netbash(){ if [[ "$(wget -S --spider $1 2>&1 | grep 'HTTP/1.1 200 OK')" ]] && [ ! "$1" == "" ]; then
           wget -qO- http://server/$1 | less; clear
           read -n1 -p "Warning: Do you really want to run this script (Y/N)? " reply; echo ""
           [ "$reply" != "Y" ] && [ "$reply" != "y" ] && echo "Aborting" && exit 1
           bash <(wget -qO- http://server/$1); else echo "No such file."; fi; }
1
  • netbash /scripts/upvote.sh as an example!
    – 5p0ng3b0b
    Mar 8 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .