This is a fun technique, but the branding here is a little bombastic: running commands whenever a public key connects is an explicitly supported feature in Open

This is a fun technique, but the branding here is a little bombastic: running commands whenever a public key connects is an explicitly supported feature in OpenSSH (and other SSH daemons, like dropbear[1]). To "exploit" this you'd need to convince someone to use it as their SSH public key, and `command=...` should be a pretty big giveaway; I wouldn't expect hiding the payload in a hex string to confuse or trick anyone except for someone who shouldn't be adding their own SSH keys to servers anyways. [1]: https://linux.die.net/man/8/dropbear https://linux.die.net/man/8/dropbear