Dangerous
eval "$(echo 'ZGF0ZSAtdQ==' | base64 -d)"linux · bash · Nightmare
Decodes an encoded string and executes whatever it contains as a shell command. The encoding exists purely so a reader, a log, and a scanner cannot see the intent; a command you cannot read is a command you cannot approve.
Signals to notice
- Encoded payload hides the real command
- eval executes decoded text
- Intent is invisible in shell history and logs
Think you can spot these under time pressure?
Start TrainingMore Shell
cat ~/.bashrcIntermediate:(){ :|:& };:Intermediateawk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | headExpertexport PATH="$HOME/.local/bin:$PATH"Expertfind ./logs -type f -name '*.log' -mtime +7 -print0 | xargs -0 -P 4 -I{} sh -c 'gzip -9 "$1"' _ {}Nightmareawk 'BEGIN{FS=","} NR>1 && $3 ~ /^2[0-9]{2}$/ {c[$2]++} END{for (k in c) printf "%-24s %6d\n", k, c[k]}' ./access.csv | sort -k2 -rn | head -20Nightmare