4 ms·

Could someone explain to me if what I think this gist shows is correct? A get request is sent to the server with additional commands added to the content, whic

Could someone explain to me if what I think this gist shows is correct? A get request is sent to the server with additional commands added to the content, which creates the file ./tmp/besh whose content comes from the ngix file from http://162.253.66.76/nginx http://162.253.66.76/nginx. The executable flag is set and then the file gets executed. The next three commands show information about the downloaded nginx file (check sums, file command info). For what reason? Is the file really an nginx server or is it just named like this to show that nginx is exploitable? I know that this is basically about the bash exploit, right? Thanks

pritambaral 12y ago
The file is only named nginx. The file has been downloaded from an untrested server, 162.253.66.76, so it could be anything really. The title/description of the gist claims it is a kernel exploit with CnC (Command and Control) capabilities. So yeah, the file is only named nginx; it doesn't have anything to do with the popular web server software of the same name. Probably named that way to avoid suspicion
- sagischwarz 12y ago
  I see. Thank you!
- CyberShadow 12y ago
  > Probably named that way to avoid suspicion Correct, it is usually done to conceal the process in process listings (top / ps aux).
  - sagischwarz 12y ago
    Thank you for the clarification!