You're viewing a single thread.
Confirm that you looked in "/bin/sh/tmp/" and not "/bin/sh /tmp" (notice the single space ' ' after the 'h').Ignore my previous comment, I was incorrect. Apologies. I had thought it was malware trying to look like something else, and that the who thing quoted was the single command, and not a command and an argument/parameter.
/bin/sh is the shell binary. The other part of that string is the argument being passed to the shell. The whole thing looks sus.
I looked in /tmp
Reread what I wrote. There may be two subdirectories named '../tmp/' on your machine.
Edit: For anyone else, how do I type just two periods? When I do, it displays as an ellipsis, three periods.
Escape one of them
\..=> ..Thank you!
Surely the space is part of the command. It's running sh with the file in /tmp as the parameter (run this file).
You're right. I assumed the whole thing is a single command, and not a command with an argument/parameter. My bad.
Didn't realize 'sh' was a shortcut to bash in and of itself. Thought you had to mark a file as an executable, like ".sh" files.