Benign cross-platform Download

server.c

C popen command executionsystem() function call

SHA-256727a9b7472e810a7bb9c196831b61df8ea47a4ac86e24eab5424cf2ad7e0e0a1

Evidence

Calls setsid() system call line 139

139    setsid();

system() function call lines 219–222

219int add_icmp_block_firewall_rule(int* rule_handle_buffer) {
  if (system("nft add table ip filter") != 0) {
      fprintf(stderr, "Error adding table \"ip filter\"");
      return 0;

C popen command execution line 230

230    FILE* r = popen("nft --handle --echo add rule ip filter INPUT icmp type echo-request drop", "r");

knock string reference lines 261–265

      printf("NOTE! No existing NFTables rules were found related to ICMP traffic.\n"
          "This means that the shyll server is not protected from being accessed\n"
          "via the firewall and consequently, the port-knocking security feature\n"
          "is not effective.\n\n");
  } else {

URL targets .php endpoint lines 319–321

319        puts("See NFT Quick Reference guide: https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes\n\n");
320    }
321}