Skip to content

Commit e47eda8

Browse files
authored
Merge pull request mantvydasb#28 from P7c0d32/master
fix a typo: commandline-obfuscation.md
2 parents 0292a4b + 40c939d commit e47eda8

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

offensive-security/defense-evasion/commandline-obfusaction.md offensive-security/defense-evasion/commandline-obfuscation.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
description: Commandline obfuscation
33
---
44

5-
# Commandline Obfusaction
5+
# Commandline Obfuscation
66

77
This lab is based on the research done by Daniel Bohannon from FireEye.
88

@@ -55,7 +55,7 @@ Introducing garbage delimiters `@` into the equation:
5555
PS C:\Users\mantvydas> cmd /c "set x=c@alc & echo %x:@=% | cmd"
5656
```
5757

58-
The above does the same as the earlier example, except that it introduces more filth into the command \(`c@lc`\). You can see from the below screenshot that Windows does not recognize such a command `c@lc`, but the second attempt when the `%x:@=%` removes the extraneous `@` symbol from the string, gets executed successfully:
58+
The above does the same as the earlier example, except that it introduces more filth into the command \(`c@alc`\). You can see from the below screenshot that Windows does not recognize such a command `c@alc`, but the second attempt when the `%x:@=%` removes the extraneous `@` symbol from the string, gets executed successfully:
5959

6060
![](../../.gitbook/assets/garbage2.png)
6161

@@ -67,7 +67,7 @@ PS C:\Users\mantvydas> cmd /c "set x=c@alc & echo %x:@=mantvydas% | cmd"
6767

6868
![](../../.gitbook/assets/garbage3.png)
6969

70-
In the above, the value `mantvydas` got inserted in the `c@lc` in place of @, suggesting that `%x:@=%` \(`:@=` to be precise\) is just a string replacement capability in the cmd.exe utility.
70+
In the above, the value `mantvydas` got inserted in the `c@alc` in place of @, suggesting that `%x:@=%` \(`:@=` to be precise\) is just a string replacement capability in the cmd.exe utility.
7171

7272
With this knowledge, the original obfuscated command
7373

0 commit comments

Comments
 (0)