26

I accidentally overwrote the /bin/bash file with a dumb script that I intented to put inside the /bin folder.

How do I get the contents of that file back? Is there a way I can find the contents on the web, and just copy them back in? What are my options here, considering that terminal gives an error talking about "Too many Symbolic Links?"

I'm still a newcomer to this kind of thing, and I appreciate all the help I can get.

Edit: I forgot to mention I'm on Kali 2.2 Rolling, which is pretty much debian with some added features.

Edit 2: I also restarted the machine, as I didn't realize my mistake until a few days ago. That makes this quite a bit harder.

Rui F Ribeiro
  • 55,929
  • 26
  • 146
  • 227
GarrukApex
  • 695
  • 1
  • 9
  • 15

3 Answers3

66

Don't shut down your machine.

Do you still have a running shell? Is it bash? If so, you're fine. (But don't do this again.)

Run:

sudo cp /proc/$$/exe /bin/bash

Voila, all is well.


Since someone in the comments doubts that this works:

[vagrant@localhost ~]$ cat /etc/shells 
/bin/sh
/bin/bash
/sbin/nologin
/bin/dash
/bin/tcsh
/bin/csh
[vagrant@localhost ~]$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[vagrant@localhost ~]$ echo $0
-bash
[vagrant@localhost ~]$ sudo rm /bin/bash
[vagrant@localhost ~]$ bash
-bash: /bin/bash: No such file or directory
[vagrant@localhost ~]$ sudo su -
su: /bin/bash: No such file or directory
[vagrant@localhost ~]$ sudo cp /proc/$$/exe /bin/bash
[vagrant@localhost ~]$ bash
[vagrant@localhost ~]$ exit
[vagrant@localhost ~]$ sudo su -
[root@localhost ~]# logout
[vagrant@localhost ~]$ 
Wildcard
  • 35,316
  • 26
  • 130
  • 258
  • 19
    In any case, after this, it is recommended to reinstall bash from your distribution, e.g. for correct permissions (some rootkit hunter could be surprised of changes there), also to restore hard link or symlink (e.g. to `/bin/sh` or `rbash`) – Giacomo Catenazzi Oct 17 '17 at 13:13
  • 4
    @GiacomoCatenazzi, actually, this method preserves permissions—that's default when `root` runs `cp`. Hard links are a good point, though. – Wildcard Oct 17 '17 at 18:02
  • 1
    The machine was restarted. I can't open a normal shell, but I can edit the contents through the GUI. As said before, I get an error stating "Failed to execute child process /bin/bash. (Too many levels of symbolic links)." – GarrukApex Oct 18 '17 at 00:56
38

bash is a shell, probably your system shell, so now weird things happen, while parts of the shell are still in memory. Once you log out or reboot, you,ll be in deeper trouble.

So the first thing should be to change your shell to something safe. See what shells you have installed

cat /etc/shells

Then change your shell to one of the other shells listed there, for example

chsh -s /bin/dash

Update, because you already rebooted:

You are lucky that nowadays the boot process doesn't rely on bash, so your system boots, you just can't get a command line. But you can start an editor to edit /etc/passwd and change the shell in the root line from /bin/bash to /bin/dash. Log out and log in again. Just don't make any other change in that file, or you may mess up your system completely.

Then try to reinstall bash with

apt-get --reinstall install bash

If everything succeeded you can chsh back to bash.

Finally: I think, kali is a highly specialized distribution, probably not suited for people who accidently overwrite their shell. As this sentence was called rude and harsh, I should add that I wrote it out of my own experience. When I was younger, I did ruin my system because nobody told me to avoid messing around as root.

Philippos
  • 13,237
  • 2
  • 37
  • 76
  • 3
    @dr01: Given how bash escaping works, it can be a matter of a misplaced quote. Think `command > /bin/bash ...` versus `command > (/bin/bash ...)`. – MSalters Oct 17 '17 at 13:15
  • 7
    That last sentence was harsh...:) – President James K. Polk Oct 17 '17 at 16:07
  • 6
    @MSalters A misplaced quote *run as root*. That's two mistakes. The second one, of course, being trying out your complicated pipelines as root, not as a non-privileged user. – derobert Oct 17 '17 at 16:30
  • There's no reason to change shells, "weird" things won't happen. bash hasn't been deleted yet if it's still running; `rm` just removed a reference to the inode but the running process keeps the inode on disk available -- just like if you`rm` any other file that's open, the file isn't actually deleted until the file handle is closed. – Josh Oct 17 '17 at 23:11
  • As I said before, I did a dumb thing. The machine was restarted. I can't open a normal shell, but I can edit the contents through the GUI. As said before, I get an error stating "Failed to execute child process /bin/bash. (Too many levels of symbolic links)." Now what are my options? Thanks for your reply – GarrukApex Oct 18 '17 at 00:59
  • @GarrukApex if you can boot into GUI can you open the GUI package manager and reinstall bash? – phuclv Oct 18 '17 at 02:52
  • @GarrukApex I updated the answer to show how to change the shell after you already rebooted. But first try the answer given by Scott. Navigate to `/bin` with the file browser. If you can't open a shell by double-clicking it, you may need to do a right click and *open with* and select `xterm`. Good luck! – Philippos Oct 18 '17 at 06:08
  • 12
    @JamesKPolk no, it isn't harsh at all. It's the simple truth. Kali is a professional tool designed to be used by *experts*. They even [state as much](https://docs.kali.org/introduction/should-i-use-kali-linux) on their webpage. If you aren't an expert, you really have no business running Kali. – terdon Oct 18 '17 at 10:58
  • I know. I installed it a while ago, and don't really use it that much. I have a debian 9 install I use most of the time when working on linux (And learning). I just made a mistake in Kali. Thanks for the help guys, I really appreciate it! – GarrukApex Oct 19 '17 at 00:23
  • Aaaand I got an error. Errors were encountered wihe processing: /var/cache/apt/archives/bash_4.4-5_amd64.deb E: Sub-process /usr/bin/dpkg returned an error code (1) – GarrukApex Oct 19 '17 at 00:35
  • What does `dpkg --configure bash` return? I'm not sure whether this is related to the original question. Maybe you should open a new question for this problem. – Philippos Oct 19 '17 at 05:47
  • I think this is still related, as it relates to bash not working. In case someone has a similar problem in the future, it'll help them out to have it all under one question. As for the command, it says that it is in an inconsistent state and that I should attempt to reinstall it. The problem with that is that apt-get --reinstall install bash doens't work for me. I just get the above error. – GarrukApex Oct 19 '17 at 23:58
  • Yes, it may be related. But with a new question you attract those people who are experienced with inconsistent `dpkg` packages. It's unlikely for them to find your current problem in the commentary here. You can post a link to the new question as a commentary here for future readers to follow. You can also link back to this question from the new one. – Philippos Oct 20 '17 at 06:14
  • 3
    The last sentence is **not** harsh. It's the plain truth. – Andrea Lazzarotto Oct 21 '17 at 13:39
  • 1
    https://unix.stackexchange.com/questions/399630/bash-was-overwritten-using-dash-apt-get-reinstall-install-bash-returns-an-er is the new question. Thanks for sticking with me on this @Philippos. I can't tell you how much I appreciate it. – GarrukApex Oct 22 '17 at 00:18
5

If you can login, but you can’t open a terminal or otherwise access a shell, but you can access files through the GUI, go to /bin, look for files whose names end with sh (but not .sh) and run one (by double-clicking or right-clicking).  In particular, look for the following:

  • sh
  • dash
  • ash
  • ksh (or ksh followed by a number; e.g., ksh93)
  • zsh
  • yash

or, as a last resort,

  • tcsh or
  • csh

If you can get a shell running, then try Philippos’s answer.

Another approach is to boot into single-user mode following these instructions but specify init=/bin/sh (or one of the other shells) instead of init=/bin/bash.