Hiding Payloads in Linux Extended File Attributes, (Thu, Jul 17th)

This report illustrates a proof-of-concept for hiding a Python reverse-shell payload in Linux extended file attributes (xattr), splitting it across multiple files, obfuscating with XOR and Base64, and later reconstructing it with a C tool; it concludes with a simple defensive tip to hunt such misuse by recursively listing xattrs using `getfattr -R`.