We can also use these logical operators inside our POSIX terminal shell in
order for us to be able to run
different commands in different scenarios. For instance, I mean, let's say we
want to run
notepad QQ from the actual terminal window right here. We have our terminal
open notepad QQ.
And when we run it, you'll notice that when notepad opens up that the
terminal is locked. And by that, I mean, we zoom in and we see that we don't
have another line to
type in commands on. So this terminal session is pretty much locked in and
unable to use for
other things until we close the existing program that was invoked. But if we go
in and type notepad
QQ with an ampersand on the end of it, you'll notice that not only do we get
the program to open up,
but as we go back to zoom in, we get a line of numbers and a new line to be
able to go in
and type commands, meaning that our shell is now unlocked for us to be able to
run things.
Why does this matter? Well, that line of numbers right there, number one,
438823 is a process ID. And it associates with a process ID folder and the logs
and such and such
and such. That being said, if we take a look at the next line, we've opened
ourselves up to a
command injection possibility here may not seem like it. But if a script or
program is written,
we can see here that something can run and have an ampersand on the end of it,
that logical operator
and open up the command shell to be free of use for somebody else to use. And
if that notepad QQ
was opened up with pseudo permissions, now we have a shell window here, a
session that is open to
use for a limited time for those admin permissions on the system if we invoke
them. Now, as I'm opening
up Wireshark on the actual desktop of our Hyper-V environment for our lab, you
'll notice that I
also have right above me task manager open as well. And the reason for this is
because I wanted to
show you a demonstration of command injection being used for the purposes of
good. And traditionally,
we see these as installer packages. Now, as Wireshark opens up, it will come up
with a installer for us
to be able to go and update Wireshark on the system itself. But Wireshark also
has a bunch of
systems that run in the background with this installer for it to be able to
determine what
packages need to be updated or installed. Do we as administrators or even
system users at our home
need to run every single installer one at a time? And you'll even notice here
that Wireshark has
three processes set to plural of that open up. One is the console window host
dump PCAP
and Wireshark and it is running. But you'll see here that we have now a
software update. And this
is going to be done in the form of an MSI installer for Microsoft. And inside
of that installer,
you'll notice that as this is running, we still have three Wireshark processes
opened up.
And you can see that we have other stuff open in as well,
such as the uninstaller. But all these processes that you see open in a closing
inside of task
manager are all related to that one single MSI that is invoked by command
number one.
And then followed on by all those separate commands that allow it to be able to
go through and run
all of this without us having to go through clicking or installing packages
individually,
removing stuff like we wanted to, all this other stuff. Basically simplistic
purposes for us to be
able to enjoy our time doing other things that may be of more importance.