4 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
The article details an experiment running `rm -rf /` on a Linux server to see what remains. It discusses the limited tools available after this destructive command and explores creative ways to recover functionality using bash builtins and scripts.
If you do, here's more
The author experiments with the command `rm -rf /` on a new Linux server, revealing what remains after executing it as root. To run this command without the safeguard that prevents it from deleting critical files, the author uses the `--no-preserve-root` flag. After the command executes, many core utilities like `/bin/ls` and `/bin/cat` are gone, but a connection over SSH and existing bash builtins such as `echo` remain functional.
With only the basic shell builtins available, the author creatively navigates the stripped-down environment. They demonstrate how to use `echo` and file globs to list files in `/dev`, `/proc`, `/run`, and `/sys`. To recreate a minimal version of the `ls` command, they define a function in bash, overcoming initial obstacles like existing aliases. The process continues with attempts to recover lost functionality, including using `cat`, and eventually leads to the idea of downloading the BusyBox utility, known for its multiple built-in commands.
Challenges arise in executing newly created binaries since all original executables have been deleted. The author explores ways to identify executables still accessible through `/proc` links but finds that these are not valid. They mention kernel-level access as a potential solution and describe using sysrq magic to restart the system. The article concludes with a summary of a Redditor's method for recovering BusyBox, showcasing a step-by-step approach that involves creating a shared object to change file permissions and make the binary executable.
Questions about this article
No questions yet.