Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Non-Linux, e.g. Solaris & FreeBSD, in-memory execution support #4

Open
HarryR opened this issue Jan 20, 2017 · 0 comments
Open

Non-Linux, e.g. Solaris & FreeBSD, in-memory execution support #4

HarryR opened this issue Jan 20, 2017 · 0 comments

Comments

@HarryR
Copy link
Collaborator

HarryR commented Jan 20, 2017

fexecve is defined in the IEEE Std 1003.1-2008 (POSIX.1-2008) standard, however it's not so widely supported by the libc of various different systems.

The aim is to avoid creating our own executable/library loader, and avoid ever writing to the filesystem as that leaves an audit-trail of sorts.

The underlying premise for Unix-like platforms relies having one of two options available:

  1. Have a /proc filesystem where open file descriptors can be accessed like regular files and passed to exec like normal paths.
  2. Have a libc or kernel system call which performs special handling of file descriptors to exec them directly, aka fexecve.

For Windows platforms there are two options available:

  1. Hook ntos.dll calls so when it tries to load an executable / library you can read from a buffer
  2. Re-implement the loader, e.g. MemoryModule or the various Meterpreter EXE loaders.

Man pages and related info for fexecve on non-Linux platforms:

@HarryR HarryR changed the title Solaris & FreeBSD in-memory support Non-Linux, e.g. Solaris & FreeBSD, in-memory execution support Jan 22, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant