MAL-SHAPE Reverse-Shell and Backdoor Idioms

A few structural shapes that almost never appear in benign first-party code but are the building blocks of a remote backdoor. They are stable language idioms, not an intelligence feed, so the rule has no blocklist that can go stale.

What Vulkro detects

Four High-severity shapes:

• MAL-SHAPE-001: a bash reverse shell over the /dev/tcp/<host>/<port> or /dev/udp/... pseudo-device.
• MAL-SHAPE-002: nc -e or ncat -e, netcat executing a program on connect.
• MAL-SHAPE-003: a Python reverse shell, a socket plus dup2 redirection plus pty.spawn or a subprocess handing control to /bin/sh or /bin/bash.
• MAL-SHAPE-004: cloud instance-metadata credential access, the literal 169.254.169.254, the /latest/meta-data/ path, or the IMDSv2 /latest/api/token exchange.

Every source file is read once, skipping node_modules and vendored trees. This is a review surface, not a verdict, and never a certificate of safety.

How to fix

• Confirm the file is not a security test fixture, then remove the code.
• Treat any machine that ran it as compromised: rotate credentials and check for outbound connections to the named host.

References

• OWASP A08:2021

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.