MAL-SHAPE Reverse-Shell and Backdoor Idioms
A small set of language-idiom-stable shapes that almost never occur in benign first-party code but are the canonical building blocks of a remote backdoor. These are evergreen structural idioms rather than an intelligence feed, so there is no blocklist to keep fresh and the rule cannot go stale.
What Vulkro detects
Four High-severity shapes.
MAL-SHAPE-001 covers a bash reverse shell over the /dev/tcp/<host>/<port> or /dev/udp/... pseudo-device, the classic handle-back shape.
MAL-SHAPE-002 covers nc -e or ncat -e, netcat wired to execute a program on connect.
MAL-SHAPE-003 covers a Python reverse shell: a socket together with dup2 file-descriptor redirection and either pty.spawn or a subprocess handing control to /bin/sh or /bin/bash. All three together are the standard interactive Python reverse shell.
MAL-SHAPE-004 covers cloud instance-metadata credential access: the literal 169.254.169.254, the /latest/meta-data/ path, or the IMDSv2 /latest/api/token token dance. In just-cloned untrusted source a hardcoded metadata reach is a credential-theft shape.
This is a review surface, not a verdict. The detector walks every source file once, skipping node_modules and vendored trees, and never certifies code safe.
Remediation. These shapes have no place in application source. Confirm the file is not a security test fixture, then remove it and treat any machine that ran the code as compromised: rotate credentials and check for outbound connections to the named host.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.