Discover and read the best of Twitter Threads about #Bash
Most recents (4)
#linux #bash #path #obfuscation
goal: obfuscate /etc/passwd
1) #directorytraversal: /mnt/././../etc/././passwd
2) escape characher: /etc/.\/\/\/\/\/passwd /etc/.\/.\/.\/.\/passwd /\e\t\c/passwd
3) null character /et$'c/pa\u0000/notexist/path'sswd
....
goal: obfuscate /etc/passwd
1) #directorytraversal: /mnt/././../etc/././passwd
2) escape characher: /etc/.\/\/\/\/\/passwd /etc/.\/.\/.\/.\/passwd /\e\t\c/passwd
3) null character /et$'c/pa\u0000/notexist/path'sswd
....
#path #obfuscation using #symbolic #link
ln -s / anything
head -n 2 anything////../etc/passwd
ln -s ../../ wow
head -n 2 ././wow/../etc/passwd
* ../ after a sym link applies to the sym link not the current path
ln -s / anything
head -n 2 anything////../etc/passwd
ln -s ../../ wow
head -n 2 ././wow/../etc/passwd
* ../ after a sym link applies to the sym link not the current path
filename expansion #globbing
cat /et*/pa**wd
command expansion
$(echo /e)tc$(echo /pa*)wd
+ other string obfuscation techniques
cat /et*/pa**wd
command expansion
$(echo /e)tc$(echo /pa*)wd
+ other string obfuscation techniques
@MalcolmNance “#ActiveMeasures,” documentary details the decades-long connection between #TrumpPutin, set an Aug. 31 release
@SenJohnMcCain
@HillaryClinton
@McFaul
@SenWhitehouse
@StevenLHall1
@Isikoff
@johnpodesta
Jeremy #Bash
James #Woolsey
#RussianAsset
#CrownJewel
variety.com/2018/film/news…
@SenJohnMcCain
@HillaryClinton
@McFaul
@SenWhitehouse
@StevenLHall1
@Isikoff
@johnpodesta
Jeremy #Bash
James #Woolsey
#RussianAsset
#CrownJewel
variety.com/2018/film/news…
@MalcolmNance @SenJohnMcCain @HillaryClinton @McFaul @SenWhitehouse @StevenLHall1 @Isikoff @johnpodesta “The Russians have a particular type of “mark.” They go after somebody who has business resources, shady morals, and political connections or aspirations. I’ve just described Donald Trump.” -Senator Sheldon #Whitehouse
#ActiveMeasures
#ActiveMeasuresMovie
#ActiveMeasures
#ActiveMeasuresMovie
@MalcolmNance @SenJohnMcCain @HillaryClinton @McFaul @SenWhitehouse @StevenLHall1 @Isikoff @johnpodesta “Putin realizes that, if we’re divided as a nation, we cannot protect ourselves from threats within and without.”
- @Evan_McMullin
“And what you have is probably the biggest intelligence breach in the history of the world.”
#ActiveMeasures
#ActiveMeasuresMovie
- @Evan_McMullin
“And what you have is probably the biggest intelligence breach in the history of the world.”
#ActiveMeasures
#ActiveMeasuresMovie
#linux #bash #obfuscation using shell parameter expansion:
alphabet=abcdefghijklmnopqrstuvwxyz
${alphabet:2:1}at really
${alphabet: -24:-23}at really
${alphabet: -24:1}at really
${alphabet:2:-23}at really
gnu.org/software/bash/…
similar #bat #windows (ss64.com/nt/syntax-subs…)
alphabet=abcdefghijklmnopqrstuvwxyz
${alphabet:2:1}at really
${alphabet: -24:-23}at really
${alphabet: -24:1}at really
${alphabet:2:-23}at really
gnu.org/software/bash/…
similar #bat #windows (ss64.com/nt/syntax-subs…)
The goal is to obfuscate the following command:
cat really
in which, really is a file.
cat really
in which, really is a file.
Using arithmetic (add, sub, mul, div, mod, and pow) for calculating index or lenght
${alphabet: 2:(-20-3)}at really
${alphabet: 2:(-20-3)}at really
#linux #bash #obfuscation using octal vals
$'\143\141\164' really
gnu.org/software/bash/…
"Words of the form $'string' are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard."
$'\143\141\164' really
gnu.org/software/bash/…
"Words of the form $'string' are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard."
Variations
$'\143'$'\141'$'\164' really
$'\143'''$'\141'''''''''''''$'\164' really
$'\143'''$'\141'''""''''""''$'\164' really
Explanation:
'' -> empty string
""-> empty string
'a''b' -> 'ab' (concatenation)
(deleted the previous one, as the picture had a problem)
$'\143'$'\141'$'\164' really
$'\143'''$'\141'''''''''''''$'\164' really
$'\143'''$'\141'''""''''""''$'\164' really
Explanation:
'' -> empty string
""-> empty string
'a''b' -> 'ab' (concatenation)
(deleted the previous one, as the picture had a problem)
To give you a headache
t=
$'\143'''$'\141'$t''"$t"''`$t`''$'\164' really
t=
$'\143'''$'\141'$t''"$t"''`$t`''$'\164' really
