Commands by faceinthecrowd (1)

  • find potentially malicious PHP commands used in backdoors and aliked scripts

    I have found that base64 encoded webshells and the like contain lots of data but hardly any newlines due to the formatting of their payloads. Checking the "width" will not catch everything, but then again, this is a fuzzy problem that relies on broad generalizations and heuristics that are never going to be perfect. What I have done is set an arbitrary threshold (200 for example) and compare the values that are produced by this script, only displaying those above the threshold. One webshell I tested this on scored 5000+ so I know it works for at least one piece of malware.


    0
    for ii in $(find /path/to/docroot -type f -name \*.php); do echo $ii; wc -lc $ii | awk '{ nr=$2/($1 + 1); printf("%d\n",nr); }'; done
    faceinthecrowd · 2013-04-05 19:06:17 11

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

Switch all connected PulseAudio bluetooth devices to A2DP profile
Tries to switch all audio devices to the A2DP profile for optimal sound quality. Useful for bluetooth speakers and headphones that always power up in HSP/HFP mode. Note however that this command is only a shorthand for the GUI, so it cannot fix stubborn BT controllers that leave your device stuck in HSP mode until a manual re-coupling.

Detect illegal access to kernel space, potentially useful for Meltdown detection
Based on capsule8 agent examples, not rigorously tested

Join lines
It's works only when you replace '\n' to ONE character.

Encode/Decode text to/from Base64 on a Mac w/out Mac Ports
I have a mac, and do not want to install mac ports to get the base64 binary. Using openssl will do the trick just fine. Note, to decode base64, specify a '-d' after 'base64' in the command. Note also the files base64.decoded.txt and base64.encoded.txt are text files.

Fire CMD every time FILE (or directory) is updated (on *BSD)

Rename files in batch

Nicely display mem usage with ps
Nicely display mem usage with ps.

Extract IPv4 addressess from file

create and md5 sum of your password
create and md5 sum of your password without it showing up in your terminal or history. Afterwards we overwrite the $p variable (thx to bazzargh)

Put a console clock in top right corner
This puts a clock in the top right of the terminal. This version doesn't use tput, but uses escape codes

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: