4 ms·
What does `echo -e "\x6F\x6B"` do?
by laktak 2y ago
What does `echo -e "\x6F\x6B"` do?
- zh3 2y agoIt prints "ok" and shows they got in (it relies just on a shell, nothing else).
- lucianbr 2y agoWhy not do 'echo "ok"'?
- kynetic 2y agoAs shown by someone having to ask what it does, it obscures what it does.
- lucianbr 2y agoDoesn't seem terribly useful. I mean it only obscures that it prints "ok". If you're looking at the logs, you probably already figured out someone is attacking you, and if you didn't, seeing "echo ok" will not help you figure it out. If the only thing the command does is "obscure what it does", then the only thing it obscures is "obscure what it does". I guess there's no requirement that whoever writes these scripts is a genuis.
- Retr0id 2y agoPeople writing malware generally don't want to deploy it on honeypots, because then they're handing their payload (and other tradecraft) directly to analysts. So often the first stage is an attempt at honeypot detection, or more broadly, device fingerprinting. A bad honeypot might not even run a real /bin/sh, and this detects that right off the bat.
- lucianbr 2y agoThat makes a lot more sense than "it obscures the obscure thing it does to obscure itself".
- ggambetta 2y agoIf you say it 3 times in front of a mirror, it summons Stallman
- moffkalast 2y agoWith or without the swords?
- withinboredom 2y agoOnly one way to find out!
- pompompurin 2y agoHaha
- ynoxinul 2y agoThis look like a simple test to see if remote command execution works.
- Mxrtxn 2y agoPrints out `ok`
- spc476 2y agoIt echos "ok".
- raverbashing 2y agoMaybe I should create a honeypot where cat, echo, sed, and curl/wget all drop random bytes in all commands they execute Would be fun
- thesnide 2y agoBetter would be to just subtly change the output... Like do a +1 on the byte every 7 bytes. Bonus to do it only on every 7 printable chars. And you can even do A/B testing on the constant 7.
- deleted 2y ago[deleted]
- gpvos 2y agoTests whether `echo` supports the `-e` option.