.shar attachments

Isn't it somewhat dangerous?

A while ago I was playing with the idea on how to create a virus on *nix. After some thought I found a shar file quite effective.
Heck, you can get it to extract and, more importantly, execute all sorts of crazy things o_O
 
I don't think that it's any different from attaching code, diffs, etc. :) You still need to run it...
 
crsd said:
I don't think that it's any different from attaching code, diffs, etc. :) You still need to run it...

You are absolutely right. Of course you need to look at what you are running. You and I probably will. You can assume someone to open an jpg with some viewer. You can assume a diff will be used with patch. But you can be dead sure someone will run a shar. Without looking. Most infections these days happen because people run all sorts of things, completely oblivious.

It's quite easy to extract and run pre-compiled (or compile them on the spot) executables with a shar. Of course, the same can be said for shell scripts. But shell scripts are readable to a certain extent and are expected to be so. A shar on the other hand is expected to contain a lot of gobble-di-goo (/me lacks a better word). That makes it relatively easy to hide things in plain sight :e
 
Back
Top