3 ms·
Can you expand a bit on the type of scripts/scenario you'd use for something like this? I presume the email + script would need to be something legitimate enoug
by thricegr8 6y ago
Can you expand a bit on the type of scripts/scenario you'd use for something like this? I presume the email + script would need to be something legitimate enough looking as to not raise any red flags during a glance over, with built in assurances you aren't causing any real harm against the target, and then properly configuring the script (or downstream actions) to then get exfil'd. Very interesting nonetheless.
- heavenlyblue 6y agoI don’t really understand what that gives the attacker. Login to the developer’s machine as in? What if they disabled SSH password auth? I mean, if you already made them run a random script why would you even care about their password?
- fulafel 6y agoTo be able to easily get root through sudo later when running the malware payload (reverse shell eg) in the background?
- heavenlyblue 6y agoYou already have sudo, you can install any malware immediately (with a rootkit on top and any kernel extensions to hide yourself)
- fulafel 6y agoMaybe you don't want to leave any log traces, kernel mods etc behind yet before getting instructions from your c&c or waiting until a set time when some other coordinated action (or a weekend) happens.