RECON06 . A PLATFORM INDEPENDENT MULTI-CAVITY NOP VIRUS
- » The motivation behind this is best explained by an example: A user's web browser gets exploited. The shellcode that the attacker runs gets the PIDs of running shells, attaches to them with ptrace() and backdoors their execve() in such a way that if the user were to execute the 'su' command, the backdoor would augment their arguments.
- » The common single '-' argument to 'su' could be augmented to be "-c '/tmp/malcode;/bin/sh'"