7 ms·
There are other ways to do this that don't involve tmpfs or write() - see https://github.com/dimkr/papaw https://github.com/dimkr/papaw and https://github.com/d
by dimkr1 7y ago
There are other ways to do this that don't involve tmpfs or write() - see https://github.com/dimkr/papaw https://github.com/dimkr/papaw and https://github.com/dimkr/Mirai-Source-Code https://github.com/dimkr/Mirai-Source-Code
- adito 7y agoBut the readme says: The payload executable is extracted to a temporary file. When running as root, this is done by mounting a tmpfs file system and lazily unmounting it before the extraction.
- dimkr1 7y agoWhen not running as root, it doesn't use a tmpfs. Also, papaw replaces /proc/self/exe with an empty file. And it has some basic anti-debugging, like locking of the payload to RAM so it cannot be recovered by reading it from a swap partition.
- dg246 7y agoSimilar - https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter...