Correct but in lots of scenarios (containers etc) you cannot execute ptrace() but you can execute mmap(), mprotect(), read(), write() which is all you really need. Edit: and fork(). See something I published just a…
You can. Different ways to skin the cat and the memfd trick works fine. However there are other ways of doing it and being more stealthy. See for example https://www.anvilsecure.com/blog/userland-execution-of-binar....…
Correct but in lots of scenarios (containers etc) you cannot execute ptrace() but you can execute mmap(), mprotect(), read(), write() which is all you really need. Edit: and fork(). See something I published just a…
You can. Different ways to skin the cat and the memfd trick works fine. However there are other ways of doing it and being more stealthy. See for example https://www.anvilsecure.com/blog/userland-execution-of-binar....…