It assumes nothing is installed
A profiling script seen in nine sessions from four networks asks every question four or five different ways: uname, then two absolute paths, then busybox, and failing all of that it greps the CPU file directly. It also reads the device tree, a file that only exists on single-board hardware. It was not written for servers.
This profiling script assumes the machine it landed on has almost nothing installed.
Code that runs on a server can take the basics for granted. The standard tools are simply there.
This one takes nothing for granted. Every question has a chain of answers behind it.
Architecture: try the normal command, then two absolute paths, then the busybox version. If all four are missing, read the processor file and match on a string instead.
Core count, the same shape. Processor model has four sources, and one of them is the device tree, a file that only exists on single-board hardware.
Seven different busybox commands are named across the script.
That is not written for servers. It is written for routers, cameras and little boards where half the usual tools were never shipped.
Anything reachable gets fingerprinted, however small it is.
#linux#security#iot#infosec#sysadmin
❯ Anything reachable gets fingerprinted, however small it is.