3

What does this shell command do in Linux

:(){ :|: & };:

How can it be used in Denial of Service attacks?

manav m-n
  • 353
  • 4
  • 16

1 Answers1

6

It's a fork bomb. I actually have that written on my whiteboard (as a joke) as I speak. Don't run it.

:()         # define a function named :, () defines a function in bash
{           
    : | :;  # the pipe needs two instances of this function, which forks two shells
}
;           # end function definition
:           # run it

So, the first run makes 2 subshells, which then each runs 2 more subshells...

: is a built in command in bash. It's kind of a "null" no-op command. It used to be the comment character, before there was a comment character. Now, it's got a small use as a no-op, but really used here because it's more cryptic, you look at :() and think WTH is that?

Rich Homolka
  • 31,057
  • 6
  • 55
  • 80
  • `:` isn't an operator, it's a built-in command that does nothing. This definition defines a function called `:`, which hides the built-in command. Here's a clearer and equivalent version ***DON'T RUN THIS EITHER*** `bomb() { bomb | bomb & ) ; bomb` – Keith Thompson Jul 29 '13 at 19:12
  • Why is everyone saying to not run this? Either Mac OS X is too clever or too broken to let this cause any damage. Just a bunch of `-bash: fork: Resource temporarily unavailable`, then the prompt is back within a second or so. – Daniel Beck Jul 29 '13 at 19:18
  • @DanielBeck I (knowingly) ran this on Solaris many years ago, needed to force a logout, though I actually just rebooted (my desktop Sparc). – Rich Homolka Jul 29 '13 at 19:26
  • Forking exponential user created memory leak. Depending on the OS, hilarity or disaster ensues. Mac knows users will do anything despite? ulimit set to prevent it from working? – Fiasco Labs Jul 29 '13 at 19:55