-1

There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as sudo rm -rf /.

How do you do this kind of obfuscation? I just tried running Cyberchef and turning my command, which is just ls -la into hex and this command doesn't execute even with \x<hexcodehere> syntax.

  • What am I doing wrong?
  • Are there any similar obfuscation methods?

P.S. I'm already aware of the base64 encoding trick, but that requires to have base64 installed on the system

Improve this question
12
  • It is unclear for me what exactly you are trying to do. My guess is that you saw something and did not properly understand how it worked. Now you are trying to do it yourself, still not understanding how it works. Did you mean pastejacking ? If not please provide a reference to what exactly you mean.
    – Steffen Ullrich
    Dec 7, 2021 at 18:35
  • No, it's not pastejacking. The user has to copy and paste the command into the terminal to execute this hex code or whatever it is. My first assumption was that it was machine code, but it looks completely different
    – Sir Muffington
    Dec 7, 2021 at 20:06
  • Again, to cite myself: "If not please provide a reference to what exactly you mean."
    – Steffen Ullrich
    Dec 7, 2021 at 20:15
  • Sorry, I apparently can't find it right now... I tried googling, I forgot how it's called. There was an article about warning about these kind of threats, but again I forgot how it's called... Does that mean now that this question should be closed? I surely hope someone knows it.
    – Sir Muffington
    Dec 7, 2021 at 20:30
  • 1
    OP, are you thinking of something like this? echo -n '6c73202d6c' | xxd -r -p | bash
    – mti2935
    Dec 7, 2021 at 20:59

1 Answer 1

Reset to default
1

when you execute this command the terminal...

The terminal or "shell" is itself a program. There are many different shell programs: sh, bash, zsh, cmd, PowerShell, etc., so the answer would in general depend on what shell you are interested in...

The shell performs two main function: (1) it launches other programs; (2) it interprets built-in shell reserved words.

For example, in bash: "alias" and "echo" are built-in reserved words that are interpreted by the shell, but "netstat" and "ls" are separate programs that are launched by the shell.

The example from the comments:

echo -n '6c73202d6c' | xxd -r -p | bash

Uses three programs (echo, xxd, and bash) commonly found on Linux platforms to create a hex string, interpret the hex string as characters, and pipe the command ("ls -l") to bash for execution.

This is one way to "execute hex," but it does rely on the fact that the platform already has programs to produce and parse hex.

I just tried running Cyberchef and turning my command, which is just ls -la into hex and this command doesn't execute even with \x syntax.

This will not work in general.

If the shell doesn't recognize the command as a program that exists in the PATH or as a built-in command it will simple respond with a warning/error message like "command not found"

Improve this answer
4
  • There's certainly a way to do that without piping, because I remember doing that myself..
    – Sir Muffington
    Dec 7, 2021 at 22:53
  • To do what without piping? Issue the "ls -l" command? Yes, you can do it by simply typing "ls -l" in the command prompt. No piping needed.
    – hft
    Dec 8, 2021 at 0:36
  • Can you provide more context? You seem to have some vague recollection of being able to do something... but what? And when? Are we talking 1995? 2015? How old is this memory?
    – hft
    Dec 8, 2021 at 0:38
  • To issue the for example ls -l command, yes. This was probably back in 2018 or 2019. Maybe I should reformulate the question to be about obfuscating and executing a command without any external tools or piping. But I gave you an upvote regardless, since you've did an extensive answer.
    – Sir Muffington
    Dec 8, 2021 at 20:55

Not the answer you're looking for? Browse other questions tagged .