pgj11: Analysis of Bincrypter and gsocket (gs-netcat)

What it is

A forensic teardown of a real Linux compromise where the attacker dropped a bincrypter-obfuscated shell script that unpacks a statically-linked gs-netcat 1.4.42beta5 (built with -stealth) reverse-shell tunnel. Initial access came via a WordPress site affected by CVE-2026-18322; the binary was placed in the site root and executed via crontab persistence. The implant was renamed netd on disk and beaconed to a private GSRN relay.

Indicators

• Relay: 103.253.27.96:443, gsocket secret 4jkuTMcyat7L6eAGJCn93t.
• On-disk name netd (arbitrary; not meaningful).
• Payload sizes noted during unpack: 1,082,290 → 1,069,776 bytes after de-escaping.
• Delivery: three-line loader script — sh shebang, Stage 0, then the AES-encrypted+gzipped ELF appended as the third line.

How it works

The loader hides its eval using a character-separator trick: in sh, : is true and ! : is false, so ! : && and : || guard statements that never run, acting as do-nothing separators splitting the real characters apart between junk. Stage 0 strips non-printable bytes (perl -pe 's/[^[:print:]]//g'), base64-decodes, and OpenSSL-decrypts to reveal bincrypter's standard _bc_dec hook.

Decryption keys off whether the script is run or sourced: $0 gives the path when executed but the shell name when sourced, so fn is empty-when-executed / set-when-sourced — the invariant driving branch selection. The final routine reads the ciphertext back from the script file, discards the first two lines and a # separator byte, reverses the packer's escaping, then AES-256-CBC decrypts and gunzips:

zf='read(STDIN,\$_,1);while(<>){s/B3/\n/g;s/B1/\\x00/g;s/B2/B/g;print}'

prg="perl -e '<>;<>;$zf'<'${0}'|openssl enc -d -aes-256-cbc -md sha256 -nosalt -k '${S}-${_P}' 2>/dev/null|perl -e 'read(STDIN,\\\$_, ${R:-0});print(<>)'|gunzip"

Decode order matters: the packer encoded B→B2, NUL→B1, LF→B3; on decode you must apply B3/B1 first and B2→B last. Encryption uses -md sha256 -nosalt (legacy KDF) with key material ${S}-${_P}, where P/S are 16 random alphanumerics from /dev/urandom, and R is a random padding length skipped after decryption.

What to do

Patch WordPress against CVE-2026-18322 and check site roots and crontabs for dropped binaries (esp. named netd). Use the author's released tooling to statically pull payloads and operator config without executing anything: Bincrypter-Extract, Gsocket-Config-Extract, plus the published YARA rules and ImHex pattern file for bincrypter-packed gsocket implants.

Caveats

The linked CVE-2026-18322 writeup is marked "coming soon," so the initial-access mechanism is not detailed here — only that WordPress was the entry point. The fetched analysis cuts off mid-sentence at the AES key description.