Pure In-Memory (Shell)Code Injection in Linux Userland

Presented at DeepSec 2018 „I like to mov &6974,%bx“, Unknown date/time (Unknown duration).

A lot of research has been conducted in recent years on performing code injection in the Windows operating system without touching the disk. The same cannot be said about *NIX (and Linux specifically).

Imagine yourself sitting in front of a blinking cursor, using a shell on a freshly compromised Linux server, and you want to move forward without leaving any trace behind. You need to run additional tools, but you don't want to upload anything to the machine. Or, you simply cannot run anything because the noexec option is set on mounted partitions. What options remain?

This talk will show how to bypass execution restrictions and run code on the machine, using only tools available on the system. It's a bit challenging in an everything-is-a-file OS, but doable if you think outside the box and use the power this system provides.

Anyone interested in offensive security should find the talk sexy, especially since it's not theoretical mumbling but a demo-rich journey through the inner workings of Linux and some old-school hacks.


Presenters:

  • reenz0h - Sektor7
    Geek by passion, engineer by profession since the last millennium. For many years he's been working in global red teams, simulating threat actors targeting IT infrastructure across various industries (financial, technology, industrial, energy, aviation) across the globe. Speaker at HackCon, NoVA Hackers, Geek Girls Carrots, Tech3.Camp, PWNing Con. Organizer of x33fcon - IT security conference for red and blue teams, held in Gdynia, Poland. Founder of Sektor7 research company.

Links:

Similar Presentations: