Detecting the use of “curl | bash” server side and exploiting this.

cat << EOF | curl -X PUT -d @- uberleet.org

 

I’m sure you’ve seen rvm.io and the bag of other sites that advocate things¬†like

\curl -sSL https://get.rvm.io | bash -s stable

Now the issue has gotten much worse, as it’s possible to detect use of curl/wget and send a different payload to the executing command.

bashmov

This is done by the way network buffers are handled with sleeping code, and allows the server to send an alternate response when detecting the sleep in the client. Here is a working proof of concept and  discussion.

EOF

Leave a Reply

Your email address will not be published. Required fields are marked *