Xz/liblzma: Bash-stage Obfuscation Explained

#1

Post by ecliptik » Sat, Mar 30, 2024, 9:08 PM UTC

Xz/liblzma: Bash-stage Obfuscation Explained
gynvael.coldwind.pl

Re: Xz/liblzma: Bash-stage Obfuscation Explained

#2

Post by [deleted] » Sat, Mar 30, 2024, 9:24 PM UTC

[deleted]

Re: Xz/liblzma: Bash-stage Obfuscation Explained

#3

Post by politelemon » Sat, Mar 30, 2024, 9:26 PM UTC

Thanks the simplified explanation and noisy image comparison is quite appreciated. It gives me a good grasp of what people mean by the sophistication involved.

I also saw a comment on reddit mentioning that the "sandboxing" method was sabotaged with a dot. It's on the line just after "#include " you can see a dot all the way on the left.

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2...

https://old.reddit.com/r/linux/comments/1brhlur/xz_utils_bac...

Re: Xz/liblzma: Bash-stage Obfuscation Explained

#4

Post by sega_sai » Sat, Mar 30, 2024, 9:53 PM UTC

Did anyone search github yet for similar head | tail tricks ? I doubt it was invented just for this.

Re: Xz/liblzma: Bash-stage Obfuscation Explained

#5

Post by nabakin » Sat, Mar 30, 2024, 11:42 PM UTC

sega_sai wrote: post #4

Did anyone search github yet for similar head | tail tricks ? I doubt it was invented just for this.

Opportunity to write a paper

Re: Xz/liblzma: Bash-stage Obfuscation Explained

#6

Post by temp12237792 » Sat, Mar 30, 2024, 11:55 PM UTC

politelemon wrote: post #3

Thanks the simplified explanation and noisy image comparison is quite appreciated. It gives me a good grasp of what people mean by the sophistication involved. I also saw a comment on reddit mentioning that the "sandboxing" method was sabotaged with a dot. It's on the line just after "#include " you can see a dot all the way on the left. https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2... https://old.redd…