{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.8949263691902161 } ], "prob": 0.89492637, "models": [ { "m": "az", "raw": 0.340856, "prob": 0.89492637, "class": 0 }, { "m": "az/source", "raw": 0.22465004, "prob": 0.91582, "class": 0 }, { "m": "az/c", "raw": 0.034747094, "prob": 0.060484607, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T04:41:14Z" }, "path": "main.c", "raw": { "v": "6", "fs": [ { "f": "O(C)H₂(CmPo₂)", "x": 5, "ff": { "i": [ [ "", "snprintf" ], [ "", "system" ], [ "", "tcgetattr" ], [ "", "fileno" ], [ "", "tcsetattr" ], [ "", "fileno" ], [ "", "getline" ], [ "", "tcsetattr" ], [ "", "fileno" ], [ "", "memset" ], [ "", "strlen" ], [ "", "strncmp" ], [ "", "strlen" ], [ "", "strcat" ], [ "", "strlen" ], [ "", "strncat" ], [ "", "malloc" ], [ "", "strcpy" ], [ "", "strlen" ], [ "", "memset" ], [ "", "strlen" ], [ "", "memset" ], [ "", "strncpy" ], [ "", "strcat" ], [ "", "memset" ], [ "", "strncpy" ], [ "", "strlen" ], [ "", "strcat" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "free" ], [ "", "snprintf" ], [ "", "snprintf" ], [ "", "base32_encode" ], [ "", "strlen" ], [ "", "count_equals" ], [ "", "modify_result" ], [ "", "snprintf" ], [ "", "strcat" ], [ "", "socket" ], [ "", "htons" ], [ "", "inet_addr" ], [ "", "memset" ], [ "", "create_header" ], [ "", "create_question" ], [ "", "build_packet" ], [ "", "free" ], [ "", "free" ], [ "", "sendto" ], [ "", "FD_ZERO" ], [ "", "FD_SET" ], [ "", "select" ], [ "", "fopen" ], [ "", "fputs" ], [ "", "fclose" ], [ "", "snprintf" ], [ "", "system" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "tcsetattr" ], [ "", "fileno" ], [ "", "exit" ], [ "", "printf" ], [ "", "fflush" ], [ "", "tcgetattr" ], [ "", "fileno" ], [ "", "tcsetattr" ], [ "", "fileno" ], [ "", "strcpy" ], [ "", "signal" ], [ "", "signal" ], [ "", "printf" ], [ "", "steal_password" ], [ "", "strlen" ], [ "", "malloc" ], [ "", "strcpy" ], [ "", "strrpc" ], [ "", "snprintf" ], [ "", "printf" ], [ "", "system" ], [ "", "WIFSIGNALED" ], [ "", "WTERMSIG" ], [ "", "user_interrupt" ], [ "", "printf" ], [ "", "save_passwd" ], [ "", "printf" ], [ "", "save_passwd" ], [ "", "fork" ], [ "", "save_passwd" ], [ "", "wait" ], [ "", "execv" ], [ "", "exit" ], [ "", "free" ], [ "", "sudo" ], [ "", "system" ], [ "", "need_password" ], [ "", "fake_sudo" ], [ "", "fork" ], [ "", "save_passwd_local" ], [ "", "send_passwd" ], [ "", "clear_all" ], [ "", "exit" ], [ "", "sudo" ], [ "", "sudo" ], [ "", "getpwuid" ], [ "", "getuid" ], [ "", "snprintf" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "hijack_sudo" ], [ "", "../dns/dns.h" ], [ "", "../encode/encode.h" ], [ "", "\u003carpa/inet.h\u003e" ], [ "", "\u003cnetinet/in.h\u003e" ], [ "", "\u003cpwd.h\u003e" ], [ "", "\u003cstdio.h\u003e" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "\u003csys/types.h\u003e" ], [ "", "\u003csys/wait.h\u003e" ], [ "", "\u003ctermios.h\u003e" ], [ "", "\u003cunistd.h\u003e" ], [ "", "main.h" ] ], "m": { "ast": { "op.eq": 13.0, "op.gt": 1.0, "op.lt": 7.0, "op.ne": 7.0, "op.add": 7.0, "op.div": 1.0, "op.mul": 10.0, "op.sub": 7.0, "op.band": 19.0, "op.bnot": 2.0, "op.lnot": 3.0, "max_depth": 17.0, "op.concat": 10.0, "bind_count": 29.0, "call_count": 111.0, "node_count": 2937.0, "member_count": 9.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.01, "op_density.bnot": 0.0, "op_density.lnot": 0.0, "identifier_count": 152.0, "member_depth_max": 3.0, "op_density.concat": 0.0, "string_literal_count": 26.0, "array_literal_max_length": 1.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 10189.0, "entropy": 4.77, "size_bytes": 10189.0 }, "text": { "tab_count": 2.0, "digit_ratio": 0.03, "space_count": 2933.0, "total_lines": 434.0, "char_entropy": 4.77, "mixed_indent": 1.0, "unique_chars": 143.0, "escape_density": 0.05, "string_density": 0.06, "avg_line_length": 22.48, "high_byte_ratio": 0.01, "max_line_length": 139.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.18, "last_line_length": 1.0, "whitespace_ratio": 0.33, "most_common_ratio": 0.05, "identifier_density": 1.2, "line_length_stddev": 22.33, "octal_escape_count": 5.0, "normalized_string_count": 1.25, "repeated_char_sequences": 89.0, "suspicious_string_ratio": 0.12, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.5, "max_inline_whitespace_run": 3.0, "trailing_whitespace_lines": 25.0, "most_common_char_codepoint": 115.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 17.35 }, "binds": { "count": 29.0 }, "calls": { "count": 111.0 }, "binary": { "overall_entropy": 4.77 }, "source": { "class_count": 5.0, "function_count": 15.0 }, "imports": { "count": 13.0, "relative_ratio": 0.15, "unique_modules": 13.0, "relative_imports": 2.0, "third_party_count": 13.0, "third_party_ratio": 1.0 }, "members": { "count": 9.0 }, "strings": { "total": 26.0, "avg_length": 16.73, "max_length": 51.0, "path_count": 6.0, "avg_entropy": 2.56, "total_bytes": 435.0, "entropy_stddev": 1.17, "shell_command_strings": 3.0 }, "comments": { "chars": 409.0, "lines": 14.0, "total": 4.0, "to_code_ratio": 0.03, "high_entropy_comments": 2.0 }, "functions": { "count": 20.0 }, "identifiers": { "count": 152.0, "total": 519.0, "avg_length": 7.91, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.58, "reuse_ratio": 0.29, "unique_count": 152.0, "length_stddev": 3.53, "has_digit_ratio": 0.01, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.01, "high_entropy_count": 6.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.16 } }, "s": [ [ 9, "u8", "\u003cstdio.h\u003e" ], [ 28, "u8", "\u003cstdlib.h\u003e" ], [ 48, "u8", "\u003cstring.h\u003e" ], [ 68, "u8", "\u003cunistd.h\u003e" ], [ 88, "u8", "\u003csys/types.h\u003e" ], [ 111, "u8", "\u003csys/wait.h\u003e" ], [ 133, "u8", "\u003cpwd.h\u003e" ], [ 150, "u8", "\u003ctermios.h\u003e" ], [ 171, "u8", "\u003cnetinet/in.h\u003e" ], [ 195, "u8", "\u003carpa/inet.h\u003e" ], [ 219, "u8", "main.h" ], [ 220, "u8", "main.h" ], [ 237, "u8", "../dns/dns.h" ], [ 238, "u8", "../dns/dns.h" ], [ 261, "u8", "../encode/encode.h" ], [ 262, "u8", "../encode/encode.h" ], [ 301, "10", "1" ], [ 321, "10", "0" ], [ 344, "10", "0" ], [ 365, "10", "2048" ], [ 667, "10", "10000" ], [ 677, "10", "0" ], [ 703, "10", "10000" ], [ 709, "u8", "/usr/bin/sudo%s" ], [ 710, "u8", "/usr/bin/sudo%s" ], [ 931, "10", "0" ], [ 1125, "10", "0" ], [ 1254, "10", "1" ], [ 1325, "10", "4096" ], [ 1359, "10", "0" ], [ 1390, "10", "0" ], [ 1534, "10", "1" ], [ 1583, "10", "1" ], [ 1735, "10", "0" ], [ 1758, "10", "0" ], [ 1775, "10", "0" ], [ 1874, "10", "0" ], [ 1979, "10", "0" ], [ 2155, "10", "100" ], [ 2199, "10", "0" ], [ 2267, "10", "63" ], [ 2290, "10", "0" ], [ 2352, "10", "0" ], [ 2455, "10", "63" ], [ 2473, "10", "63" ], [ 2495, "10", "63" ], [ 2634, "10", "63" ], [ 2675, "10", "63" ], [ 2769, "10", "1" ], [ 2826, "10", "1" ], [ 3013, "u8", "success" ], [ 3014, "u8", "success" ], [ 3066, "u8", "fail" ], [ 3067, "u8", "fail" ], [ 3111, "10", "0" ], [ 3177, "u8", "%s:%s:%s\\n" ], [ 3178, "u8", "%s:%s:%s" ], [ 3251, "10", "4096" ], [ 3335, "u8", "%s:%s" ], [ 3336, "u8", "%s:%s" ], [ 3601, "u8", "%d.%s%s" ], [ 3602, "u8", "%d.%s%s" ], [ 4067, "10", "0" ], [ 4320, "10", "0" ], [ 4391, "10", "0" ], [ 4595, "10", "0" ], [ 4629, "10", "1" ], [ 4672, "10", "0" ], [ 4808, "u8", "w" ], [ 4809, "u8", "w" ], [ 4901, "10", "0" ], [ 4944, "u8", "mv %s ~/%s \u003e /dev/null 2\u003e\u00261;rm %s \u003e /dev/null 2\u003e\u00261" ], [ 4945, "u8", "mv %s ~/%s \u003e /dev/null 2\u003e\u00261;rm %s \u003e /dev/null 2\u003e\u00261" ], [ 5124, "10", "0" ], [ 5142, "u8", "\\n" ], [ 5177, "10", "1" ], [ 5195, "u8", "sudo: %d incorrect password attempt\\n" ], [ 5196, "u8", "sudo: %d incorrect password attempt" ], [ 5276, "u8", "sudo: %d incorrect password attempts\\n" ], [ 5277, "u8", "sudo: %d incorrect password attempts" ], [ 5409, "10", "1" ], [ 5536, "u8", "[sudo] password for %s: " ], [ 5537, "u8", "[sudo] password for %s: " ], [ 5660, "10", "0" ], [ 5870, "10", "0" ], [ 6023, "10", "0" ], [ 6114, "10", "4096" ], [ 6138, "10", "0" ], [ 6270, "10", "1" ], [ 6347, "u8", "[sudo] password for %s: " ], [ 6348, "u8", "[sudo] password for %s: " ], [ 6496, "10", "1" ], [ 6704, "u8", "\\" ], [ 6709, "u8", "\\'\\\"\\'\\\"\\" ], [ 6780, "u8", "echo '%s' | /usr/bin/sudo -S whoami \u003e/dev/null 2\u003e\u00261" ], [ 6781, "u8", "echo '%s' | /usr/bin/sudo -S whoami \u003e/dev/null 2\u003e\u00261" ], [ 6867, "u8", "\\n" ], [ 6903, "10", "0" ], [ 6983, "10", "1" ], [ 7216, "10", "0" ], [ 7277, "10", "1" ], [ 7325, "u8", "sudo: %d incorrect password attempts\\n" ], [ 7326, "u8", "sudo: %d incorrect password attempts" ], [ 7494, "10", "0" ], [ 7600, "u8", "Sorry, try again.\\n" ], [ 7601, "u8", "Sorry, try again." ], [ 7731, "10", "0" ], [ 7857, "10", "0" ], [ 7910, "10", "0" ], [ 7984, "10", "1" ], [ 8209, "u8", "/usr/bin/sudo" ], [ 8210, "u8", "/usr/bin/sudo" ], [ 8258, "10", "0" ], [ 8521, "u8", "/usr/bin/sudo -n true 2\u003e/dev/null" ], [ 8522, "u8", "/usr/bin/sudo -n true 2\u003e/dev/null" ], [ 8578, "10", "256" ], [ 8600, "10", "1" ], [ 8631, "10", "0" ], [ 9095, "10", "0" ], [ 9472, "10", "0" ], [ 9742, "10", "10000" ], [ 9752, "10", "0" ], [ 9778, "10", "1000" ], [ 9840, "10", "1" ], [ 9957, "u8", " %s" ], [ 9958, "u8", " %s" ], [ 10002, "10", "0" ], [ 10005, "u8", "sudo" ], [ 10006, "u8", "sudo" ], [ 10033, "10", "1" ], [ 38, "xor", "cEIF4%37,gr287-F" ], [ 78, "xor", "cEIF4%37,gr256k\\" ], [ 101, "xor", "cEIF4%37,gr256k_" ], [ 132, "xor", "IZP_3g.mCd'//)1L" ], [ 161, "xor", "cEIF4%37,gr/)1-F" ], [ 227, "xor", "cEIF4%37,globj F" ], [ 251, "xor", "cEIF4%37,globj!F" ], [ 448, "xor", ";nld_\u0026lSIGNALE" ], [ 488, "xor", "RFT@2'Lsignaled" ], [ 489, "xor", "i2-!J\u0026lSIGNALEK'" ], [ 532, "xor", ":f61@CFSIGNALED6" ], [ 545, "xor", "IFED$,Lsignaled]" ], [ 587, "xor", "ifedBEFSIGNALED.Ee:9\"*'}:;aOn" ], [ 589, "xor", "IFFA]ifsignal8" ], [ 879, "xor", "IFINwa20.\": 816" ], [ 903, "xor", "a516AM!ZEGH" ], [ 1062, "xor", "IFINwa20:\": 816" ], [ 1172, "xor", "i516AM!ZRmdALED'" ], [ 1334, "xor", "IFIF#i/hCgnal(!E" ], [ 1409, "xor", " mnm_\u0026lSIGNALE" ], [ 1461, "xor", ";olm_\u0026lSIGNALEDs^e \u00265}!+516" ], [ 1463, "xor", "@O[\"wifsignaled" ], [ 1545, "xor", "4#)7AWFSIGNALEDZ" ], [ 1573, "xor", "ELS\\%ims k" ], [ 1664, "xor", "clIF#iL0\u00262 5" ], [ 1709, "xor", "IFIF#i/srMnale-F" ], [ 1726, "xor", "i%*1JXlNIWUkLEDs" ], [ 1804, "xor", " mnm_\u0026lSIGNALE" ], [ 1844, "xor", "TA\tS]ifsignaled" ], [ 1872, "xor", "tfum_\u0026lSIGNALEDs^estre=g},471" ], [ 1873, "xor", "IV\tS]ifsignaled" ], [ 1919, "xor", "IF]\"wifsignaled" ], [ 1955, "xor", "ifedY\u0026FSIGN" ], [ 1978, "xor", "ivld_\u0026lSIGNALE" ], [ 2026, "xor", "ifedY\u0026FSIGN" ], [ 2135, "xor", "%#nulCfsig-)-7d\\" ], [ 2163, "xor", "IFIF#i/hCMnale)M" ], [ 2288, "xor", "tfum_\u0026lSIGNALE" ], [ 2317, "xor", ":27-JKwyIGNA" ], [ 2330, "xor", "i#)7AWFSIGNALED5" ], [ 2363, "xor", " mnm_\u0026lSIGNALEDs^e\u003e1?61}!=#(4" ], [ 2364, "xor", "BM\tS]ifsignaled" ], [ 2489, "xor", "i2 )Twz@4GSA" ], [ 2550, "xor", "ifedY\u0026lSIGNALE\t6" ], [ 2718, "xor", "ifedY\u0026FSIGN" ], [ 2775, "xor", "nhbm_\u0026lSIGNALED\u003e" ], [ 2776, "xor", "GA\tS]ifsignale)G" ], [ 2837, "xor", "ifedY\u0026FSIGN" ], [ 2976, "xor", "IFC@6;fy:3/596d" ], [ 3043, "xor", "ifed_\u0026lSIGNALE" ], [ 3075, "xor", "ifedY\u0026FSIGN" ], [ 3133, "xor", ":#nl~2Lsignaled[" ], [ 3161, "xor", "EFSA-,)5a3+98lh" ], [ 3167, "xor", "\u0026 m0AT8ZEGLD" ], [ 3222, "xor", "i#)7AWFSIGNALED0" ], [ 3585, "xor", "EFSA-,)5a3+98lh" ], [ 3591, "xor", "\u0026 m0AT8ZEGLD" ], [ 3648, "xor", "ifedY\u0026FSIGN" ], [ 3704, "xor", "(*)m.WFSIGN" ], [ 3732, "xor", "'f 2M@wyIGNA" ], [ 3757, "xor", "ILPI4\"#'rMnale-F" ], [ 3758, "xor", "c6$'OI8HcGNAL" ], [ 3775, "xor", ":)\u0026/BHwyIGNA" ], [ 3828, "xor", "ANSG4\" 7izn2#\u0026/M" ], [ 3884, "xor", "dwld_\u0026lSIGNALE" ], [ 3898, "xor", ";#11VBwyIGNA" ], [ 4068, "xor", "EFSA-,)5a\"8( k7A" ], [ 4247, "xor", "o6$'OI8ZRmdALED5" ], [ 4299, "xor", "IFIF#i/hCgnal#+ZTM" ], [ 4340, "xor", "ifed_\u0026lSIGNAL" ], [ 4419, "xor", "EFSD2'ohCMnaled" ], [ 4440, "xor", ",2e\"@_wyIGNALED" ], [ 4489, "xor", "-jc\"@_eHcGNALEDs" ], [ 4521, "xor", " + +QXwyIGNALED'" ], [ 4564, "xor", ";0adlCfsignal1-E" ], [ 4645, "xor", "E@TA:,)\u0026=nuKled" ], [ 4678, "xor", "ifed_\u0026lSIGNALEDs^76 '7:2" ], [ 4680, "xor", "IF[\"wifsignaledZ" ], [ 4780, "xor", "IFFXwtf5\u00267+/d" ], [ 5104, "xor", "IFINwa46=57" ], [ 5122, "xor", "tfum_\u0026lSIGNAL" ], [ 5175, "xor", "tftm_\u0026lSIGNAL" ], [ 5255, "xor", "i#)7AWFSIGNALE" ], [ 5332, "xor", "ifedY\u0026FSIGN" ], [ 5361, "xor", "a51 MBe_I3-2-#(" ], [ 5464, "xor", "\u0026( m_\u0026lSIGNALE" ], [ 5513, "xor", ";+,*E@wyIGNALEDs" ], [ 5609, "xor", "IFINwa20.\": 816" ], [ 5659, "xor", "IV\t\"wifsignaled" ], [ 5713, "xor", ";+,*E@wyIGNALEDs" ], [ 5754, "xor", ",%hglCLsignaledZ" ], [ 5808, "xor", "IFINwa20:\": 816" ], [ 5832, "xor", "a51 MBe_I3-2-#(" ], [ 5869, "xor", "IV\t\"wifsignaled" ], [ 5885, "xor", ";#11VBwyIGNA" ], [ 6273, "xor", "ifed_\u0026lSIGNALE" ], [ 6312, "xor", ",2rq~Cfsignale?\"TESTRET\t\t" ], [ 6322, "xor", "ifed_\u0026lSIGNALEDs^e#\u0026;+ o!k" ], [ 6444, "xor", "@]*\"wifsignaled" ], [ 6559, "xor", "\u0026%$0MC\".IZNF0UChtOstret))ifed" ], [ 6573, "xor", "N]*\"wifsignaled" ], [ 6618, "xor", "A\nEF~rLsignaled" ], [ 6668, "xor", "@]*\"wifsignaled" ], [ 6721, "xor", "@]*\"wifsignaled" ], [ 6871, "xor", "@]*\"wifsignaled" ], [ 6903, "xor", "Y]*\"wifsignaled" ], [ 6951, "xor", "@]*\"wifsignaled" ], [ 6983, "xor", "X]*\"wifsignaled" ], [ 7021, "xor", "=old_\u0026lSIGNALEDs^estre=o)a" ], [ 7023, "xor", "@F[\"wifsignaled" ], [ 7056, "xor", "=#60VI8ZIZSA?,#" ], [ 7070, "xor", "./n|~2Lsignaled" ], [ 7149, "xor", "./n|~rLsignaled" ], [ 7168, "xor", "ifedY\u0026lSIGNALEDs^e.^Xet))ifed" ], [ 7170, "xor", "IF]\"wifsignaled" ], [ 7215, "xor", "IV\t\"wifsignaled" ], [ 7227, "xor", "ifed_\u0026lSIGNALEDs^estre=o)a4 0VU" ], [ 7247, "xor", "IFINwa46=57" ], [ 7276, "xor", "DW\t\"wifsignaled" ], [ 7292, "xor", "ifed_\u0026lSIGNALEDs^estret))i67-JX*[K" ], [ 7294, "xor", "IF[\"wifsignaled" ], [ 7372, "xor", ",2rq~rLsignaled" ], [ 7411, "xor", ":#nl~2Lsignaled" ], [ 7514, "xor", "ifedY\u0026lSIGNALEDs^estret))i4 0Q^\"S" ], [ 7516, "xor", "IF]\"wifsignaled" ], [ 7570, "xor", "ifedY\u0026FSIGNALEDs^estrety{ (1\"" ] ], "v": { "file.stem": "main", "file.basename": "main.c", "source.language": "c", "source.imports[0]": "../dns/dns.h", "source.imports[1]": "../encode/encode.h", "source.imports[2]": "\u003carpa/inet.h\u003e", "source.imports[3]": "\u003cnetinet/in.h\u003e", "source.imports[4]": "\u003cpwd.h\u003e", "source.imports[5]": "\u003cstdio.h\u003e", "source.imports[6]": "\u003cstdlib.h\u003e", "source.imports[7]": "\u003cstring.h\u003e", "source.imports[8]": "\u003csys/types.h\u003e", "source.imports[9]": "\u003csys/wait.h\u003e", "source.strings[0]": " + +QXwyIGNALED'", "source.strings[1]": " mnm_\u0026lSIGNALE", "source.strings[2]": " mnm_\u0026lSIGNALEDs^e\u003e1?61}!=#(4", "source.strings[3]": "%#nulCfsig-)-7d\\", "source.strings[4]": "%5 d_\u0026lSIGNALE", "source.strings[5]": "%d.%s%s", "source.strings[6]": "%s:%s:%s", "source.strings[7]": "%s:%s:%s\\n", "source.strings[8]": "\u0026 m0AT8ZEGLD", "source.strings[9]": "\u0026%$0MC\".IZNF0UChtOstret))ifed", "source.has_imports": true, "source.imports[10]": "\u003ctermios.h\u003e", "source.imports[11]": "\u003cunistd.h\u003e", "source.imports[12]": "FD_SET", "source.imports[13]": "FD_ZERO", "source.imports[14]": "WIFSIGNALED", "source.imports[15]": "WTERMSIG", "source.imports[16]": "base32_encode", "source.imports[17]": "build_packet", "source.imports[18]": "clear_all", "source.imports[19]": "count_equals", "source.imports[20]": "create_header", "source.imports[21]": "create_question", "source.imports[22]": "execv", "source.imports[23]": "exit", "source.imports[24]": "fake_sudo", "source.imports[25]": "fclose", "source.imports[26]": "fflush", "source.imports[27]": "fileno", "source.imports[28]": "fopen", "source.imports[29]": "fork", "source.imports[30]": "fputs", "source.imports[31]": "free", "source.imports[32]": "getline", "source.imports[33]": "getpwuid", "source.imports[34]": "getuid", "source.imports[35]": "hijack_sudo", "source.imports[36]": "htons", "source.imports[37]": "inet_addr", "source.imports[38]": "main.h", "source.imports[39]": "malloc", "source.imports[40]": "memset", "source.imports[41]": "modify_result", "source.imports[42]": "need_password", "source.imports[43]": "printf", "source.imports[44]": "save_passwd", "source.imports[45]": "save_passwd_local", "source.imports[46]": "select", "source.imports[47]": "send_passwd", "source.imports[48]": "sendto", "source.imports[49]": "signal", "source.imports[50]": "snprintf", "source.imports[51]": "socket", "source.imports[52]": "steal_password", "source.imports[53]": "strcat", "source.imports[54]": "strcpy", "source.imports[55]": "strlen", "source.imports[56]": "strncat", "source.imports[57]": "strncmp", "source.imports[58]": "strncpy", "source.imports[59]": "strrpc", "source.imports[60]": "sudo", "source.imports[61]": "system", "source.imports[62]": "tcgetattr", "source.imports[63]": "tcsetattr", "source.imports[64]": "user_interrupt", "source.imports[65]": "wait", "source.strings[10]": "\u0026( m_\u0026lSIGNALE", "source.strings[11]": "'f 2M@wyIGNA", "source.strings[12]": "(*)m.WFSIGN", "source.strings[13]": "(*m%H@eHcGNALEDs^estret))ifedY\u0026lSIGNALEDs^estret))i#)7A\u0026lSIGNALEDs^estret))i=Od", "source.strings[14]": ",%hglCLsignaledZ", "source.strings[15]": ",2e\"@_wyIGNALED", "source.strings[16]": ",2rq~Cfsignale?\"TESTRET\t\t", "source.strings[17]": ",2rq~rLsignaled", "source.strings[18]": "-jc\"@_eHcGNALEDs", "source.strings[19]": "../dns/dns.h", "source.strings[20]": "../encode/encode.h", "source.strings[21]": "./n|~2Lsignaled", "source.strings[22]": "./n|~rLsignaled", "source.strings[23]": ".3(!JX?ZEGLAI", "source.strings[24]": "/\nAO~Cfsignaled", "source.strings[25]": "/fm4MHlNTG^HfEDs^estret))ifed_\u0026lSIGNALEDs^estret))i/#d", "source.strings[26]": "/usr/bin/sudo", "source.strings[27]": "/usr/bin/sudo -n true 2\u003e/dev/null", "source.strings[28]": "/usr/bin/sudo%s", "source.strings[29]": "4#)7AWFSIGNALEDZ", "source.strings[30]": ":#nl~2Lsignaled", "source.strings[31]": ":#nl~2Lsignaled[", "source.strings[32]": ":#nl~Cfsignaled", "source.strings[33]": ":)\u0026/BHwyIGNA", "source.strings[34]": ":27-JKwyIGNA", "source.strings[35]": ":f61@CFSIGNALED6", "source.strings[36]": ";\"mm.WFSIGN", "source.strings[37]": ";#11VBwyIGNA", "source.strings[38]": ";+,*E@wyIGNALEDs", "source.strings[39]": ";0adlCfsignal1-E", "source.strings[40]": ";nld_\u0026lSIGNALE", "source.strings[41]": ";olm_\u0026lSIGNALEDs^e \u00265}!+516", "source.strings[42]": "\u003carpa/inet.h\u003e", "source.strings[43]": "\u003cnetinet/in.h\u003e", "source.strings[44]": "\u003cpwd.h\u003e", "source.strings[45]": "\u003cstdio.h\u003e", "source.strings[46]": "\u003cstdlib.h\u003e", "source.strings[47]": "\u003cstring.h\u003e", "source.strings[48]": "\u003csys/types.h\u003e", "source.strings[49]": "\u003csys/wait.h\u003e", "source.strings[50]": "\u003ctermios.h\u003e", "source.strings[51]": "\u003cunistd.h\u003e", "source.strings[52]": "=#60VI8ZIZSA?,#", "source.strings[53]": "=old_\u0026lSIGNALEDs^estre=o)a", "source.strings[54]": "\u003e\"m%H@eHcGNALEDs^estret))ifedY\u0026lSIGNALEDs^estre)", "source.strings[55]": "@F[\"wifsignaled", "source.strings[56]": "@O[\"wifsignaled", "source.strings[57]": "@]*\"wifsignaled", "source.strings[58]": "A\nEF~rLsignaled", "source.strings[59]": "ANSG4\" 7izn2#\u0026/M", "source.strings[60]": "BM\tS]ifsignaled", "source.strings[61]": "DW\t\"wifsignaled", "source.strings[62]": "E@TA:,)\u0026=nuKled", "source.strings[63]": "EFSA-,)5a\"8( k7A", "source.strings[64]": "EFSA-,)5a3+98lh", "source.strings[65]": "EFSD2'ohCMnaled", "source.strings[66]": "ELS\\%ims k", "source.strings[67]": "G:N\n~rLsignaled", "source.strings[68]": "GA\tS]ifsignale)G", "source.strings[69]": "IFC@6;fy:3/596d", "source.strings[70]": "IFED$,Lsignaled", "source.strings[71]": "IFED$,Lsignaled]", "source.strings[72]": "IFFA]ifsignal8", "source.strings[73]": "IFFXwtf5\u00267+/d", "source.strings[74]": "IFIF#i/hCMnale)M", "source.strings[75]": "IFIF#i/hCgnal#+ZTM", "source.strings[76]": "IFIF#i/hCgnal(!E", "source.strings[77]": "IFIF#i/srMnale-F", "source.strings[78]": "IFINwa20.\": 816", "source.strings[79]": "IFINwa20:\": 816", "source.strings[80]": "IFINwa46=57", "source.strings[81]": "IFS\\6=3 izn2560M", "source.strings[82]": "IF[\"wifsignaled", "source.strings[83]": "IF[\"wifsignaledZ", "source.strings[84]": "IF]\"]ifsignaled", "source.strings[85]": "IF]\"wifsignaled", "source.strings[86]": "IF]\"wifsignaledZ", "source.strings[87]": "II\n\"wifsignaled", "source.strings[88]": "ILPI4\"#'rMnale-F", "source.strings[89]": "IV\t\"wifsignaled", "source.strings[90]": "IV\tS]ifsignaled", "source.strings[91]": "IZP_3g.mCd'//)1L", "source.strings[92]": "N]*\"wifsignaled", "source.strings[93]": "RFT@2'Lsignaled", "source.strings[94]": "Sorry, try again.", "source.strings[95]": "Sorry, try again.\\n", "source.strings[96]": "TA\tS]ifsignaled", "source.strings[97]": "TFFG%\"nzrMnaled", "source.strings[98]": "WIDM!f(\u0026%+lhwON", "source.strings[99]": "X]*\"wifsignaled", "source.functions[0]": "*\nmodify_result(char *encoded_string)", "source.functions[1]": "* \nfake_sudo(struct passwd *usrInfo,int argc,char arguments[],char *params[])", "source.functions[2]": "clear_all()", "source.functions[3]": "count_equals(char *encoded_string)", "source.functions[4]": "hijack_sudo(struct passwd *usrInfo,int argc,char arguments[],char *params[])", "source.functions[5]": "main(int argc, char *argv[])", "source.functions[6]": "need_password()", "source.functions[7]": "save_passwd(char *name,char *password,char *all, int success)", "source.functions[8]": "save_passwd_local(char *all)", "source.functions[9]": "send_passwd(char *all)", "source.strings[100]": "Y]*\"wifsignaled", "source.strings[101]": "[sudo] password for %s: ", "source.strings[102]": "\\'\\\"\\'\\\"\\", "source.strings[103]": "a51 MBe_I3-2-#(", "source.strings[104]": "a516AM!ZEGH", "source.strings[105]": "c6$'OI8HcGNAL", "source.strings[106]": "cEIF4%37,globj F", "source.strings[107]": "cEIF4%37,globj!F", "source.strings[108]": "cEIF4%37,gr/)1-F", "source.strings[109]": "cEIF4%37,gr256k\\", "source.strings[110]": "cEIF4%37,gr256k_", "source.strings[111]": "cEIF4%37,gr287-F", "source.strings[112]": "clIF#iL0\u00262 5", "source.strings[113]": "dwld_\u0026lSIGNALE", "source.strings[114]": "e6$6EA?ZRmdALED!", "source.strings[115]": "echo '%s' | /usr/bin/sudo -S whoami \u003e/dev/null 2\u003e\u00261", "source.strings[116]": "i#)7A\u0026lSIGNALEDs^estr\u003e^))ifed", "source.strings[117]": "i#)7AWFSIGNALE", "source.strings[118]": "i#)7AWFSIGNALED0", "source.strings[119]": "i#)7AWFSIGNALED5", "source.strings[120]": "i%*1JXlNIWUkLEDs", "source.strings[121]": "i2 )Twz@4GSA", "source.strings[122]": "i2-!J\u0026lSIGNALEK'", "source.strings[123]": "i51%PY?HcmNALE", "source.strings[124]": "i516AM!ZRmdALED'", "source.strings[125]": "if (WIFSIGNALED(testret))ifedWY(", "source.strings[126]": "if (WIFSIGNALEDs^es/Xet))ifed", "source.strings[127]": "ife9.QlScm", "source.strings[128]": "ifedBEFSIGNALED.Ee:9\"*'}:;aOn", "source.strings[129]": "ifedY\u0026FSIGN", "source.strings[130]": "ifedY\u0026FSIGNALEDs^estrety{ (1\"", "source.strings[131]": "ifedY\u0026lSIGNALE\t6", "source.strings[132]": "ifedY\u0026lSIGNALEDs^e.^Xet))ifed", "source.strings[133]": "ifedY\u0026lSIGNALEDs^e.^ret))ife9.", "source.strings[134]": "ifedY\u0026lSIGNALEDs^e.^ret))ifed", "source.strings[135]": "ifedY\u0026lSIGNALEDs^estret))i4 0Q^\"S", "source.strings[136]": "ifedY\u0026lSIGNALEK|", "source.strings[137]": "ifedY\u0026lSIGdALED#", "source.strings[138]": "ifed_\u0026lSIGNAL", "source.strings[139]": "ifed_\u0026lSIGNALE", "source.strings[140]": "ifed_\u0026lSIGNALEDs^76 '7:2", "source.strings[141]": "ifed_\u0026lSIGNALEDs^e#\u0026;+ o!k", "source.strings[142]": "ifed_\u0026lSIGNALEDs^estre=o)a4 0VU", "source.strings[143]": "ifed_\u0026lSIGNALEDs^estret))i%)!E^", "source.strings[144]": "ifed_\u0026lSIGNALEDs^estret))i67-JX*[K", "source.strings[145]": "ifed_\u0026lSIGNALEDs^estret))ifed", "source.strings[146]": "ifed_\u0026lSIGNALEDs^estre{#", "source.strings[147]": "ivld_\u0026lSIGNALE", "source.strings[148]": "ize%VK/HBL", "source.strings[149]": "main.h", "source.strings[150]": "mv %s ~/%s \u003e /dev/null 2\u003e\u00261;rm %s \u003e /dev/null 2\u003e\u00261", "source.strings[151]": "nhbm_\u0026lSIGNALED\u003e", "source.strings[152]": "o6$'OI8ZRmdALED5", "source.strings[153]": "success", "source.strings[154]": "sudo: %d incorrect password attempt", "source.strings[155]": "sudo: %d incorrect password attempt\\n", "source.strings[156]": "sudo: %d incorrect password attempts", "source.strings[157]": "sudo: %d incorrect password attempts\\n", "source.strings[158]": "td61@CnHcmNALE", "source.strings[159]": "tf#+VGdZRmNALEDs^estret)) elTE(STZNQEoDs^estret))ifed_\u0026lSIGNALEDs^estret)):3\u0026'A_?5", "source.strings[160]": "tftm_\u0026lSIGNAL", "source.strings[161]": "tfum_\u0026lSIGNAL", "source.strings[162]": "tfum_\u0026lSIGNALE", "source.strings[163]": "tfum_\u0026lSIGNALEDs^estre=g},471", "source.strings[164]": "|pld_\u0026lSIGNALE", "source.functions[10]": "steal_password(char **lineptr, size_t *n, FILE *stream)", "source.functions[11]": "strrpc(char **str,char *oldstr,char *newstr)", "source.functions[12]": "sudo(char arguments[])", "source.functions[13]": "user_interrupt(int signo)", "source.functions[14]": "user_wakeup(int signo)" }, "ct": [ "FD_SET", "FD_ZERO", "WIFSIGNALED", "WTERMSIG", "base32_encode", "build_packet", "clear_all", "count_equals", "create_header", "create_question", "execv", "exit", "fake_sudo", "fclose", "fflush", "fileno", "fopen", "fork", "fputs", "free", "getline", "getpwuid", "getuid", "hijack_sudo", "htons", "inet_addr", "malloc", "memset", "modify_result", "need_password", "printf", "save_passwd", "save_passwd_local", "select", "send_passwd", "sendto", "signal", "snprintf", "socket", "steal_password", "strcat", "strcpy", "strlen", "strncat", "strncmp", "strncpy", "strrpc", "sudo", "system", "tcgetattr", "tcsetattr", "user_interrupt", "wait" ], "id": "c", "mc": [ "evil.sin_addr", "evil.sin_addr.s_addr", "evil.sin_family", "evil.sin_port", "evil.sin_zero", "fakeTerminal.c_lflag", "timeout.tv_sec", "timeout.tv_usec", "usrInfo.pw_name" ] }, "id": 0, "sz": 10189, "ts": [ { "c": 1.0, "d": "shell code embedded in string", "e": [ "mv %s ~/%s \u003e /dev/null 2\u003e\u00261;rm %s \u003e /dev/null 2\u003e\u00261" ], "i": "metadata/lang/embedded::shell", "l": 2, "el": [ "embedded@0x1350:0x1350" ] }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1071", "c": 0.6600000262260437, "d": "Uses sendto socket call", "e": [ "sendto" ], "i": "micro-behaviors/communications/socket/send::sendto-symbol", "l": 3, "m": "C0001", "el": [ "1101" ] }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2, "el": [ "12b3" ] }, { "d": "select() I/O multiplexing", "e": [ "select" ], "i": "micro-behaviors/communications/socket/multiplex::select-multiplex", "l": 3, "el": [ "1207" ] }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1 }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "c": 0.20000000298023224, "d": "pwd keyword", "e": [ "pwd" ], "i": "micro-behaviors/data/text/keywords/lexicon::pwd", "l": 1 }, { "d": "Get user ID (text)", "e": [ "getuid(" ], "i": "micro-behaviors/os/privilege/query::getuid-text", "l": 2 }, { "c": 0.75, "d": "snprintf formatting function", "e": [ "snprintf" ], "i": "micro-behaviors/data/format/string::snprintf-format", "l": 2 }, { "a": "T1548.003", "c": 0.75, "d": "sudo argv program name", "e": [ "sudo" ], "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-argv-name", "l": 1, "el": [ "2715" ] }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2, "el": [ "25ef" ] }, { "a": "T1105", "c": 0.8999999761581421, "d": "hidden file under /tmp", "e": [ "/tmp/.impost3r" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::stage-path-tmp", "l": 1, "m": "B0024" }, { "a": "T1548.003", "c": 0.8500000238418579, "d": "sudo binary path", "e": [ "/usr/bin/sudo" ], "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-binary-path", "l": 1, "el": [ "2011" ] }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "a": "T1059.004", "c": 0.8799999952316284, "d": "system call on prepared buffer", "e": [ " system(command)" ], "i": "objectives/command-and-control/dropper/execution/self-extract::system-buffer-exec", "l": 3, "m": "E1059" }, { "c": 1.0, "d": "Raw socket send call", "e": [ " sendto(" ], "i": "micro-behaviors/communications/socket/send::send-call-raw", "l": 3 }, { "c": 0.8999999761581421, "d": "system() function call", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/invoke::system-fn", "l": 3, "el": [ "2e7" ] }, { "c": 0.7200000286102295, "d": "Datagram socket type constant", "e": [ "SOCK_DGRAM" ], "i": "micro-behaviors/os/bpf/program/network::sock-dgram-source", "l": 1 }, { "c": 0.30000001192092896, "d": "Password pattern reference (suffix)", "e": [ "steal_password" ], "i": "objectives/credential-access/ssh/key::password-pattern-2", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary number", "e": [ "number" ], "i": "metadata/file/text/format::vocab-number", "l": 1 }, { "c": 0.800000011920929, "d": "C fork child process", "e": [ "fork()" ], "i": "micro-behaviors/process/fork/clone::c-fork-call", "l": 2 }, { "a": "T1033", "d": "Get password file entry by UID", "e": [ "getpwuid" ], "i": "micro-behaviors/process/user/query::getpwuid", "l": 3, "m": "E1033", "el": [ "25e6" ] }, { "a": "T1059", "c": 0.75, "d": "Get terminal attributes", "e": [ "tcgetattr" ], "i": "micro-behaviors/process/tty/pty::tcgetattr", "l": 3, "el": [ "375" ] } ], "sha": "fb06a764fac7e01ef3a15d1d3796a5332ceb726c9e89e8d1fd8799eb4f02aa2d", "path": "main.c", "type": "c" } ], "tv": "318d5" } }