3 ms·
On the evading detection side, one other simple way to avoid this is to add sponge[0] between curl and bash in the pipeline, i.e. curl ... | sponge | bash. spon
by michaelmior 8y ago
On the evading detection side, one other simple way to avoid this is to add sponge[0] between curl and bash in the pipeline, i.e. curl ... | sponge | bash. sponge consumes all input until EOF before outputting anything, stopping bash from executing a partially downloaded script.
[0] https://linux.die.net/man/1/sponge https://linux.die.net/man/1/sponge
- skunkworker 8y agoIf you're on a Mac or a system that doesn't have sponge installed by default, use moreutils to install. https://joeyh.name/code/moreutils/ https://joeyh.name/code/moreutils/ https://rentes.github.io/unix/utilities/2015/07/27/moreutils-package/ https://rentes.github.io/unix/utilities/2015/07/27/moreutils...
- mehrdadn 8y agoThanks, this is helpful!
- andrewstuart2 8y agoJust curl it to tee or redirect to a file and you know it won't change before you execute the script file. There's nothing stopping somebody from even more trivially just sending each IP a benign script once (per curl user agent) and a malicious script the second time. Putting it in a file and executing the file brings it entirely into your domain of control.
- deleted 8y ago[deleted]