spy on pts's shell script

This commit is contained in:
tosu 2023-04-13 18:15:31 +02:00
parent 1d95ede8db
commit f091078622
1 changed files with 31 additions and 0 deletions

31
mon.sh Executable file
View File

@ -0,0 +1,31 @@
#!/usr/bin/env bash
#Requires sudo, strace and GNU grep
echo "<START>"
sudo strace \
-e trace=write \
-s 1000 \
-f \
$(ps u |
grep pts |
grep Ss |
grep -v grep |
awk '{print "-p " $2 " "}' |
xargs) \
2>&1 |
grep \
--line-buffered \
-o '".*[^"]"' |
grep \
--line-buffered \
-o '[^"]*[^"]' |
while IFS="" read -r char; do
printf '%b' "$char"
done
echo "<END>"