Command-grab-lnx-v1-1.zip

Now you know. Have you ever found a weird binary from the early 2000s? Share your story in the comments—or better yet, tell me you still run UDP grabbers in production. I won’t judge. Much.

command-grab solved a simple problem: “I want to see the live command history and process list of a remote box without logging in every 10 seconds.”

It was elegant. It was also terrifyingly insecure. Here’s the kicker: v1.1 had no authentication . Any packet to port 31337 would trigger the grab. If you ran this on a public server, anyone on the network could ask, “Hey, what commands are running right now?” command-grab-lnx-v1-1.zip

No README . No website. Just 1.2 MB of compiled mystery.

I couldn’t resist. I unzipped it on an isolated VM. What I found wasn’t malware, nor a game. It was a strange, elegant, and almost forgotten piece of Linux history. Inside the zip was a single 32-bit ELF binary: grab . No man page. Running strings on it revealed a few clues: nc -l -p 31337 , /var/log/cmd.log , and a header: CMDGRAB v1.1 - (c) 2004 tty0n1n3 . Now you know

And for 20 years, that tiny v1-1.zip sat on a backup drive, waiting for someone curious enough to ask: What’s inside?

That’s why the zip file died out by v2.0. Real monitoring tools (Nagios, Zabbix, SNMP) won. And thank goodness. I won’t judge

But in 2004, on a trusted LAN? People used this. I know, because I found a second file in the zip: grabber.conf with a single line: