nerdexam
GIAC

GCIH · Question #827

Which of the following commands will immediately end a UNIX shell session without saving the history?

The correct answer is C. kill -9 $$. kill -9 $$ sends SIGKILL to the current shell process ($$ resolves to the current PID), terminating it instantly before bash can write history to disk.

Vulnerability Exploitation & Privilege Escalation

Question

Which of the following commands will immediately end a UNIX shell session without saving the history?

Options

  • Aunset HISTFILE
  • Brm HISTFILE
  • Ckill -9 $$
  • Drm $HOME/.bash_history

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    13% (3)
  • C
    74% (17)
  • D
    9% (2)

Why each option

kill -9 $$ sends SIGKILL to the current shell process ($$ resolves to the current PID), terminating it instantly before bash can write history to disk.

Aunset HISTFILE

unset HISTFILE prevents bash from saving history to a file on normal exit but does not immediately end the session.

Brm HISTFILE

rm HISTFILE attempts to delete a literal file named 'HISTFILE' in the current directory rather than the variable-referenced history file, so it fails or removes an unintended file.

Ckill -9 $$Correct

kill -9 $$ sends the unblockable SIGKILL signal to the current shell's process ID (represented by $$). Because the process is forcibly terminated by the kernel before it can execute any cleanup routines, bash never gets the opportunity to flush the session's command history to the HISTFILE, leaving no trace of the session's commands.

Drm $HOME/.bash_history

rm $HOME/.bash_history deletes the existing history file but does not end the current session, and in-memory history for the active session may still be written on a clean exit.

Concept tested: Linux shell history suppression via SIGKILL

Source: https://www.gnu.org/software/bash/manual/bash.html#Bash-History-Facilities

Topics

#anti-forensics#bash history#evidence destruction#Linux commands

Community Discussion

No community discussion yet for this question.

Full GCIH Practice