1

There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as sudo rm -rf /.

How do you do this kind of obfuscation? I just tried running Cyberchef and turning my command, which is just ls -la into hex and this command doesn't execute even with \x<hexcodetwocharactershere>\x<hexcodetwocharactershere> syntax.

  • What am I doing wrong?
  • Are there any similar obfuscation methods?

P.S. I'm already aware of the base64 encoding trick, but that requires to have base64 installed on the system

To summarise, I would like to not use any other tools than bash to accomplish my goal (so no base64 encoding tools and similar, no xxd, no piping)

2 Answers 2

3

The \x6c\x73\x20\x2d\x6c\x61 code, in most shells would try to run the x6cx73x20x2dx6cx61 command as \ is just another quoting operator.

In the es or fish shells, it would try to run the ls -la command and likely fail as there's no command by that name. In es, \ is not a quoting operator but can be used to expand C-like escape sequences.

In fish \ is both a quoting operator (like in sh/csh) and an escape sequence introducer like in es.

In both, \x20 would not be interpreted as the token delimiter that a real space character is in the syntax of the shell, so it would not run the ls command with -la as argument.

Same if you entered $'\x6c\x73\x20\x2d\x6c\x61' in shells that support that ksh93-style form of quote.

You'd need the expansion of those to be interpreted as shell code, for instance by feeding it to eval, sh -c, source...

eval $'\x6c\x73\x20\x2d\x6c\x61'

Or at least for it to undergo splitting:

code=$'\x6c\x73\x20\x2d\x6c\x61'
$code # using split+glob in POSIX shells
$=code # explicit IFS-splitting in zsh
${(s[ ])code} # explicit splitting on space in zsh
1

I’m not sure this matches the spirit of the question, although it works with only bash:

eval "$(printf "%b" "\x6c\x73\x20\x2d\x6c\x61")"

You can check the decoded command before running it with

printf "%b\n" "\x6c\x73\x20\x2d\x6c\x61"
3
  • There used to be a way in Ubuntu (back in 2018/2019 at least) to execute shellcode/hexcode/smth similar. People used to say it's machine code, which I'm skeptical about. Can the terminal somehow execute machine code without a program to interpret it (besides bash itself)? Dec 10, 2021 at 19:12
  • I’m not aware of a way to do that in a single step — you could write the shellcode to a file and then run that... Dec 10, 2021 at 22:10
  • Though not standard \xHH is recognised in %b arguments by several implementations of printf including zsh's and GNU's, not only bash's builtin printf. See also ksh93's eval $'\x6c...' (to be included in the next POSIX version) Dec 11, 2021 at 7:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .