I'm getting a little tired of blog posts that are just raw, unedited ChatGPT output, chief.
If you have arbitrary code execution, you can execute more arbitrary code on disk without calling exec. Better yet if you care about stealth is to not touch the disk at all, and keep everything in memory, downloading your next stage from a server directly into RAM.
It's nothing revolutionary, essentially change your own process for another binary, but for this you need to take over the process in the first place which is usually the hard part.
It's mildly interesting that they didn't call exec() and parse the elf manually, but that's about it.
3 comments
[ 4.5 ms ] story [ 19.0 ms ] threadIf you have arbitrary code execution, you can execute more arbitrary code on disk without calling exec. Better yet if you care about stealth is to not touch the disk at all, and keep everything in memory, downloading your next stage from a server directly into RAM.
It's mildly interesting that they didn't call exec() and parse the elf manually, but that's about it.