Discover and read the best of Twitter Threads about #bashfuscation
Most recents (2)
#linux #bash #obfuscation #technique #bashfuscation
padding commands with history expansion characters (#exclamation mark (!))
! ! ! ! echo this is test
(removed the previous tweet as I revealed too much info !)
padding commands with history expansion characters (#exclamation mark (!))
! ! ! ! echo this is test
(removed the previous tweet as I revealed too much info !)
#linux #bash #obfuscation #bashfuscation
using history expansion character -> !! (i.e. last command)
ca
!!t really
is equivalent to
cat really
(only 4 interactive shell)
using history expansion character -> !! (i.e. last command)
ca
!!t really
is equivalent to
cat really
(only 4 interactive shell)
#linux #bash #obfuscation #bashfuscation
padding commands with empty commands (: ;)
: -> true (do nothing)
; -> command separator
: : ; : ; cat really
! ! ! : : ; : ; cat really
padding commands with empty commands (: ;)
: -> true (do nothing)
; -> command separator
: : ; : ; cat really
! ! ! : : ; : ; cat really
#linux #bash #obfuscation using octal vals
$'\143\141\164' really
gnu.org/software/bash/…
"Words of the form $'string' are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard."
$'\143\141\164' really
gnu.org/software/bash/…
"Words of the form $'string' are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard."
Variations
$'\143'$'\141'$'\164' really
$'\143'''$'\141'''''''''''''$'\164' really
$'\143'''$'\141'''""''''""''$'\164' really
Explanation:
'' -> empty string
""-> empty string
'a''b' -> 'ab' (concatenation)
(deleted the previous one, as the picture had a problem)
$'\143'$'\141'$'\164' really
$'\143'''$'\141'''''''''''''$'\164' really
$'\143'''$'\141'''""''''""''$'\164' really
Explanation:
'' -> empty string
""-> empty string
'a''b' -> 'ab' (concatenation)
(deleted the previous one, as the picture had a problem)
To give you a headache
t=
$'\143'''$'\141'$t''"$t"''`$t`''$'\164' really
t=
$'\143'''$'\141'$t''"$t"''`$t`''$'\164' really
