netelf

netelf copied to clipboard

Execute local system program using LD_PRELOAD injected from memfd

1

Is it possible to send a shared object to netelf, then have it execute a local program with arguments and an LD_PRELOAD environment variable pointing to an fd created with...

HarryR

According to http://nadeausoftware.com/articles/2012/01/c_c_tip_how_use_compiler_predefined_macros_detect_operating_system ``` #if defined(__unix__) || (defined(__APPLE__) && defined(__MACH__)) ``` Support for running from memory on macOS works like: https://github.com/CylanceVulnResearch/osx_runbin/blob/master/run_bin.c This changes the executable type to MH_BUNDLE, but it...

HarryR

Run a .dll or .so file instead of executable

2

On Windows use [MemoryModule](https://github.com/fancycode/MemoryModule), on Linux just dlopen the file or socket. `argv[0]` should be the symbol name to load and call. Then call the symbol with: symbol(socket_handle, argc, argv);

HarryR

fexecve is defined in the IEEE Std 1003.1-2008 (POSIX.1-2008) standard, however it's not so widely supported by the libc of various different systems. The aim is to avoid creating our...

HarryR

e.g. Bash on Windows, or 'Linux' zones in Solaris... `__NR_memfd_create` is a preprocessor macro, so we can test for it's existence at compile-time and disable code which uses that syscall....

HarryR

In `_win32.c` and `netelf.c` the default IP address and port is hard-coded. Need to be able to customise it at compile time, either by editing a `config.h` file or via...

HarryR