On Sun, Nov 13, 2022 at 09:05:03PM -0600, David Wright wrote:
> On Sun 13 Nov 2022 at 14:50:58 (+0000), Andrew M.A. Cater wrote:
> > On Sun, Nov 13, 2022 at 06:04:51AM -0800, peter@easthope.ca wrote:
> > > root@joule:/home/root# /bin/ping -c 3 192.168.0.12
> > > PING 192.168.0.12 (192.168.0.12) 56(84) bytes of data.
> > > 64 bytes from 192.168.0.12: icmp_seq=1 ttl=64 time=0.079 ms
> > > 64 bytes from 192.168.0.12: icmp_seq=2 ttl=64 time=0.114 ms
> > > 64 bytes from 192.168.0.12: icmp_seq=3 ttl=64 time=0.113 ms
> > >
> > > --- 192.168.0.12 ping statistics ---
> > > 3 packets transmitted, 3 received, 0% packet loss, time 2041ms
> > > rtt min/avg/max/mdev = 0.079/0.102/0.114/0.016 ms
> > > root@joule:/home/root# echo $PATH
> > > /usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:.
>
> Nobody has commented on that final period yet … … … … … … ↑
I didn't see it. Yeah, that's *nasty*. I don't think it's directly
related to whatever the OP's current problem is, but it's a trap waiting
to strike.
The OP is clearly not running a standard Debian system. With root's
home directory having been moved, and now with some evidence that the
PATH given to root has a massive security hole in it, I'm convinced
this is some derivative OS.
Perhaps whoever put the ":." on root's PATH is also responsible for
the alias or function that's overriding "ping". I'm starting to get
rather curious about this whole situation.
Yes, this user runs as root all the time, from previous threads: