Hi, fellow Maboxers.
I want to share this tip that may be handy in the future.
Bad actors are abusing the ANSI Control Sequences in order to “hide” payload in text files. The simplicity and naive approach is what makes this attack dangerous, specially if you are working on servers without a graphical interface. As a PoC, open your console and create this file:
printf 'Good line.\nInvisible line \033[2K\033[1A\n' > badtextfile.txt
Now, if you issue a cat badtextfile.txt the offending line (ie. the one pointing to malware) is not printed at all. The simplest solution is passing the -v parameter to cat and so it prints (instead of interpreting) those ANSI sequences. As an extra measure it’s a good idea to include the alias in your .bashrc file:
alias cat='cat -v'
The more and less commands are inmune to this “trick” but cat is the most common way to take a quick glance into a text file, specially if they are small in size. So, be a little more wary of unknown text files even if the execute attribute is not set.
