Daniel Roberson
  • Posts
  • About
  • Notes
  • Projects
  • Time
  • Posts
    About
    Notes
    Projects
    Time

curl | sh

0001-01-01

Software developers and malware often abuses the built-in functionality of the shell to execute data piped into it. Software, malicious or benign, may host installation scripts on a web server and install itself using curl to execute a script hosted remotely with a command like this:

curl hxxp://foo[.]net/installer.sh | sh

Links to this note

  • analyzing_react2shell-metcalfe-Pearce2026
  • sliverintro-malone2023
  • Skidmap malware

Recent Posts

Installing C and C++ Compilers on pfSense

2026-09-05 pfsense freebsd c c++ development firewall

Linux Persistence: Modular Software

2025-04-17 DFIR CTF persistence linux persistence apache asterisk

Linux Persistence: Web Shells

2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP

Linux Persistence: Rootkits

2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking

Linux Persistence: Processes

2025-04-11 DFIR persistence processes linux persistence processes


Home

About

Notes

Projects

Time

© All rights reserved. Powered by Hugo and Erblog.