Posts

Showing posts with the label BASH

Decryption and Analysis of a "Shell" Backdoor

Image
UPDATE [l] : shortly after finishing this post, I had decided to do a couple scans of the raw code. The results returned several Shell Trojan variants, and doing some permanent damage to windows systems. Reports available at ] VirusTotal ] and [ Malwr ]. Thanks to both services for the great results. It attempted network connx with the original url, not surprise from a webshell, IMO, only a bit strange that the likely 0wn/Op would keep such a trophy case in the wild like that? I mean really??. I would've expected an http request or few since nce that's who was hosting the assets but the requests were made to connect to "Hostthshellcode and then starts the endless streaming of the v1c's data and a continual stream of fresh code for the mal to swap out. This only confirmed the feeling I had about the src code. Multiple langs being used, illogical syntax and it's all just mixed together... if anyone can answer how this can support the back and forth exec using Perl,...

Twelve Unique Linux Commands that Should Never be Used

After implementing a fork bomb in eleven different language implementations ~] the tuto [~ , I got inspired to revisit the few strings when executed in the Linux terminal, can be all kinds of destructive to the host. I'm not re-inventing the wheel here. Many of you probably know them, (and the variants), there's nothing new here. However, it's a good practice to review these type of things from time to time. So enjoy but do not run any of these on your system. I have provided descriptions for each, discussing what the results will be if you make a mistake. If these are new to you, understand the precautions, and do not use any of these. Thank you. . rm rf The rm -rf command is a simplistic, low level cmd an one of the fastest ways to delete files, dirs and their contents. But a little ignorance of the cmds may result in an unrecoverable system, even damage hw. Some of the destructive options used with rm are: . rm              //* base cmd use...