0

The first if statement doesn't work if there is no output from the command. I also tried to evaluate the exit status but this also doesn't work?

unhide-tcp output:

# unhide-tcp 
Unhide-tcp 20130526
Copyright © 2013 Yago Jesus & Patrick Gouin
License GPLv3+ : GNU GPL version 3 or later
http://www.unhide-forensics.info
Used options: 
[*]Starting TCP checking

Found Hidden port that not appears in ss: 1025

Found Hidden port that not appears in ss: 1026
[*]Starting UDP checking

Script:

#!/usr/bin/env bash

unhide-tcp | grep "^Found" | while IFS=":" read -a PORT; do

        if [ -z ${PORT[1]} ]; then

            echo "No hidden ports found."

        elif [ -n ${PORT[1]} ]; then

            echo ${PORT[@]}

        fi

done

3 Answers 3

1

I think what you simply need is:

unhide-tcp | grep "^Found" || echo "No hidden ports found."

It would print lines like Found Hidden port that not appears in ss: 1025 and if those lines aren't found, script would print "No hidden ports found." instead - because grep returns nonzero if it doesn't find a match.

If you want to condense your output of ports into a single line, you can use sed and readarray with process substitution:

readarray -t PORTS < <(exec unhide-tcp | sed -nr 's|^Found.*: ([0-9]+).*|\1|p')
[[ ${#PORTS[@]} -gt 0 ]] && echo "${PORTS[@]}" || echo "No hidden ports found."

It could give an output like 1025 1026 or No hidden ports found..

0

Flags such as -z require an argument. In your example the expansion of the $PORT variable may be blank. Wrap the variable name in double quotes.

if [ -z "${PORT[1]}" ]; then ...

1
  • Thanks for your reply but unfortunately this still doesn't work.
    – HTF
    Commented Jul 22, 2014 at 12:22
0

You will be better off using awk like this:

unhide-tcp | awk -F':' '/Found/ && NF==2{c++; print} END{if (c==0) print "No hidden ports found"}'

When I used it on the input shown in your question I get this output:

Found Hidden port that not appears in ss: 1025
Found Hidden port that not appears in ss: 1026
8
  • There will be a different action based on the output so ideally I need these IF statements.
    – HTF
    Commented Jul 22, 2014 at 12:23
  • Sure you can use: unhide-tcp | awk -F': *' '/Found/{ if (NF<2) print "No hidden ports found"; print $0 }'
    – anubhava
    Commented Jul 22, 2014 at 13:47
  • I just tested and I also don't get any output with awk if there are no any hidden ports.
    – HTF
    Commented Jul 22, 2014 at 14:16
  • I guess I don't understand what you mean by hidden port. Can you show a sample output of unhide-tcp for hidden ports?
    – anubhava
    Commented Jul 22, 2014 at 14:19
  • Please see unhide-tcp output: section in the main question.
    – HTF
    Commented Jul 22, 2014 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.