4 ms·
Neat! A more foolproof method might be sending a bit of bash that triggers a callback request (ie "liveness check", "latest version check" etc) to origin server
by nodoodles 4y ago
Neat! A more foolproof method might be sending a bit of bash that triggers a callback request (ie "liveness check", "latest version check" etc) to origin server, and pauses.
When the callback is received, continue with malicious payload, otherwise after some timeout, send a benign script..
- jameshart 4y agoThis approach seems much simpler and more reliable than detecting the pipe buffer is full.
- catalypso 4y agoThat would indeed be more precise, but it would be harder to obfuscate. If I simply curl the script (without piping to bash), I'd be less suspicious if I saw a sleep than I would be if I saw a callback to a server.