3 ms·
Isn't that obvious this is some sort of macro being executed? That makes totally sense for me and explains a lot of things, like: 1) not doing ls commands 2)
by leandroico 16y ago
Isn't that obvious this is some sort of macro being executed? That makes totally sense for me and explains a lot of things, like:
1) not doing ls commands
2) having rescue plans like trying different directories in case a directory doesn't exist
3) doing instant URL pastes
4) doing stuff in loop
5) acting similarly to a robot
6) [feel free to add more here]
- ahi 16y agoIf it was a macro it would get something right. A macro would fail in response to a road block of some sort. This guy just failed at everything.
- JonnieCache 16y agoIt is not a script, because he mistypes things and hits backspace. Not to mention all the commands that are downright invalid, eg. cd ". " A script sophisticated enough to replicate the behaviour of a real user at a shell like this would likely actually achieve something. Anyone clever enough to write a script that does this, wouldn't, because they'd also be clever enough to realise that it's utterly pointless. The win2k service pack was likely filling the role of "a big file from a fast CDN," for the purposes of testing the machine's connection.
- jeffcoat 16y ago'cd ". "' is valid; it means "set the current directory to the one named [dot][space]". I assumed it was something he'd seen as a way to sortof-conceal a directory, since it's both hidden and looks a lot like the [dot] directory that you'd expect to find everywhere.
- dibarra 16y agoActually, you guys are both right. Speaking from experience (administrator at a popular webhosting company), he likely a lot of his rootkits macroed, so he can just login to the box, alt+1 (or whatever he has his macro set to) and then pop out. When the macros fail, he demonstrates his lack of actual knowledge of *nix systems and starts acting erratically.
- fedd 16y agothe guy could be in a hurry. or stoned