Arbitrarily execute swift code from the terminal.
swift swift Sandbox: execFile · Timeout: 30s
security.execution.command security.defenseevasion.bypass Execute Swift code file: Executes the Swift code that is in a .swift file
swift mycode.swift Execute Swift one-liner before swift 5.8 / Xcode 14.3 Beta 1: Executes a Swift one-liner by piping an echoed string into the swift command
echo 'print("loobins")' | swift - Execute Swift one-liner with swift 5.8 / Xcode 14.3 Beta 1 or greater: Executes a Swift one-liner that executes the ls command to list the current directory using the -e option that was implemented in swift 5.8 / Xcode 14.3 Beta 1
swift -e 'import Foundation; let process = Process(); process.executableURL = URL(fileURLWithPath:"/bin/bash"); process.arguments = ["-c", "ls -alh"]; let stdout = Pipe(); let stderr = Pipe(); process.standardOutput = stdout; process.standardError = stderr; try process.run(); print(String(decoding: stdout.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self)); print(String(decoding: stderr.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self));' | Type | Rule / Indicator |
|---|---|
| other | Process & Command Line Argument Detection (process contains swift) |
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/swift_oneline_command_execution Jamf Protect: Detect arbitrary code execution using a swift one-liner |
The swift command is an interactive environment (REPL) for Swift.