Thread by @DissectMalware

#linux #bash #obfuscation #technique #bashfuscation
padding commands with history expansion characters (#exclamation mark (!))
! ! ! ! echo this is test
(removed the previous tweet as I revealed too much info !)

#linux #bash #obfuscation #bashfuscation

using history expansion character -> !! (i.e. last command)

ca
!!t really

is equivalent to
cat really

(only 4 interactive shell)

#linux #bash #obfuscation #bashfuscation

padding commands with empty commands (: ;)

: -> true (do nothing)
; -> command separator

: : ; : ; cat really
! ! ! : : ; : ; cat really

#linux #bash #obfuscation #bashfuscation
padding commands with piping true (: | or true |) or false (false |)

: | : | cat really
! ! : | : | date
true | date
false | true | false | date

#linux #bash #obfuscation #bashfuscation

padding commands with command substitution (`` or $()) + inline comment

`` echo test
`# something misleading` echo test
$() echo test
echo `# misleading` test

#linux #bash #obfuscation #bashfuscation

last but not least in this series

padding commands using and (||) or (&&) operators

false || date
true && cat really

#short_circuit
false && cat really will not print anything
cat really && (date || will not be executed) #mislead

clarification
false && cat really <--- will not print anything

I should also thank @danielhbohannon as I got the idea of padding commands from his #DOSfuscation tool.

* the techniques are new (at least to the best of my knowledge). Some of them can be used in batch as well like and or operators