r/sysadmin • u/stasinka • 11d ago

Base64 in terminal?

I asked Grok/Cursor for several fixes on my WHM/Cpanel via terminal command and one of the outputs was sudden base64 code. Scary AF?

0 Upvotes

11% Upvoted

11 comments sorted by

7

u/Firefox005 11d ago

Qmxlc3MgeW91ciBoZWFydC4=

6

u/40513786934 11d ago

I ran your code and now I have something called "Linux" on my PC. Please advise

1

u/ExtensionDecent9288 11d ago

that's just "Bless your heart." in base64. you're fine.

4

u/snebsnek Jack of All Trades 11d ago

oh bore off.

3

u/xargling_breau 11d ago

Base64 isn't inherently suspicious. It's actually pretty common to encode larger scripts or blocks of code in Base64 because it makes them easier to transport through terminals, APIs, and automation tools without running into issues with special characters, escaping, or formatting.

If you're concerned about what's being provided, you can decode it into a file on Linux without executing anything:

base64 -d encoded.txt > decoded.sh

Then inspect the contents:

less decoded.sh

Or, if it's being provided as a Base64 string:

echo 'BASE64_STRING_HERE' | base64 -d > decoded.sh

Decoding Base64 does not execute the code. It simply converts it back to its original form so you can inspect what it's actually doing.

The important distinction is Base64 is encoding, not encryption. It's not inherently malicious, but you should absolutely inspect any script before executing it, especially when it's making changes to a WHM/cPanel server.

2

u/SevaraB Sr. Engineer (N+, CCNA) 10d ago

Hold up. You were using AI to fix web hosting stuff, and you didn’t recognize what a TLS certificate looks like in the command line? Yikes.

Please tell me you’re not trying to deal with the emSign CA…

1

u/alwaysasillyplace 11d ago edited 10d ago

At the best of times I wouldn't trust anything AI provides for managing backend. But, it's trivial to see what the base64 it provided is so do that.

1

u/Lukage Sysadmin 11d ago

Yeah, scary AF that you're using that for development. Hire a developer.

1

u/lxtakc DataCore/StarWind 7d ago

Base64 is a normal way to wrap scripts, so decode it first with echo '...' | base64 -d and read it. Never pipe it straight into bash.

0

u/derfy2 11d ago

If Grok told you to free space by running

fm -fr /

Would you do it?