Thread by @DissectMalware

#linux #bash #obfuscation using shell parameter expansion:

alphabet=abcdefghijklmnopqrstuvwxyz
${alphabet:2:1}at really
${alphabet: -24:-23}at really
${alphabet: -24:1}at really
${alphabet:2:-23}at really

gnu.org/software/bash/…
similar #bat #windows (ss64.com/nt/syntax-subs…)

The goal is to obfuscate the following command:
cat really
in which, really is a file.

Using arithmetic (add, sub, mul, div, mod, and pow) for calculating index or lenght
${alphabet: 2:(-20-3)}at really

what about a #null character? (my #fav)
${alphabet: 2:1}${alphabet: -n:-n}at really
${alphabet: 2:1}${alphabet: n:0}at really
*where n is a positive number

${alphabet: 2:1}${alphabet: x:y}at really
*where (x,y) are out of range

To make it worse:
numbers in bash can be represented in various forms
for example number 10 is:
10 #decimal
012 #octal
0xa 0Xa #hexadecimal
2#1010 base#number #binary

* leading zeros are ignored

ref: tldp.org/LDP/abs/html/n…

#bash #arithmetic #expansion for #obfuscation
example: #ipaddr
goal: #ping 8.8.8.8
8.8.8.8 is 134744072
obfuscated:
ping $((32#40G208))
ping $((32#40G1VU+16#a))
ping $((32#40G1VU+16#9+13#1))

Repr IP with num mentioned by others:

https://twitter.com/gravislizard/status/974437617952440321