1 of 312

Hi, Mom!

1

2 of 312

Living Under the Land�On Linux

Stuart McMurray

BSides Belfast ~ 11 September 2025

3 of 312

$ whoami

  • Stuart McMurray
  • Principal Offensive Security Engineer
  • Unix Nerd
  • Libera: stuart
  • LinkedIn: @stuart--m
  • Et cetera: (?i)magisterquis
    • Twitter, Discord, GitHub, such

/* TODO: Twitter QR code here */

3

Code: github.com/magisterquis/lutlol

4 of 312

$ whoami

  • Stuart McMurray
  • Principal Offensive Security Engineer
  • Unix Nerd
  • Libera: stuart
  • LinkedIn: @stuart--m
  • Et cetera: (?i)magisterquis
    • Twitter, Discord, GitHub, such

/* TODO: Twitter QR code here */

4

Code: github.com/magisterquis/lutlol

Red Teamer

5 of 312

$ whoami

  • Stuart McMurray
  • Principal Offensive Security Engineer
  • Unix Nerd
  • Libera: stuart
  • LinkedIn: @stuart--m
  • Et cetera: (?i)magisterquis
    • Twitter, Discord, GitHub, such

/* TODO: Twitter QR code here */

5

Code: github.com/magisterquis/lutlol

Attender of Meetings

6 of 312

Disclaimers

  1. The views and ideas expressed in this talk belong to the speaker and do not necessarily reflect the official policy or position of any current or past employer.
  2. Writing and using malware should be done with care. Be sure to consult with appropriate technical, management, and legal advisors before attempting any such activities.
  3. The information presented in this talk is not specific to evading any particular defensive product’s or project’s capabilities.
  4. For legal use only.

6

7 of 312

Up Next...

Very roughly, with some other bits in there as well

  1. A Simple Shell
  2. A Discourse on Deconstruction Linux Operations into a Collection of Related System Calls
  3. H4x

7

8 of 312

A Simple Shell

8

9 of 312

Initial access

9

10 of 312

Curlrevshell - Listening

10

Code: github.com/magisterquis/curlrevshell

11 of 312

Curlrevshell - The General Idea

11

12 of 312

Curlrevshell - The General Idea

12

13 of 312

Curlrevshell - The General Idea

13

https://not-h4x.lol/$ID/o

https://not-h4x.lol/$ID/i

14 of 312

Curlrevshell - The General Idea

14

Output

Commands

15 of 312

Curlrevshell - The General Idea

15

Shell Stdout/Stderr via Curl

Shell Stdin via Curl

16 of 312

Curlrevshell - The General Idea

16

Shell Stdout/Stderr via Curl

Shell Stdin via Curl

Syscalls

17 of 312

Callback

17

18 of 312

Callback

18

19 of 312

Callback

19

20 of 312

Callback

20

21 of 312

Callback

21

22 of 312

Callback

22

23 of 312

Callback

23

24 of 312

Callback

24

25 of 312

Situational Awareness

25

26 of 312

Situational Awareness - An admin?

26

27 of 312

Situational Awareness - EDR, such as it is

27

28 of 312

Situational Awareness - The other end of exploit.sh

28

29 of 312

Situational Awareness - Kinda goofy

29

30 of 312

Situational Awareness - Not root

30

31 of 312

Situational Awareness - No custom code (yet)

31

32 of 312

Situational Awareness - Probably not in a container

32

33 of 312

A Simple Shell - So...?

33

tl;dr - We type things, target does things

34 of 312

A Simple Shell - So...?

34

tl;dr - We type things, target does things

I'm a Teal Deer...

35 of 312

Things which aren't quite Hacking yet

35

36 of 312

Things which aren't quite Hacking yet

36

Philosophical Rambling

- Mrs. McMurray

37 of 312

Back to the shell

37

38 of 312

Back to the shell - "Us"

38

39 of 312

Back to the shell - A command

39

40 of 312

Back to the shell - A program

40

41 of 312

Back to the shell - Programs

41

42 of 312

The bulk of Linux theft: Reading files

42

43 of 312

The bulk of Linux theft: Reading files

43

44 of 312

The bulk of Linux theft: Reading files

44

45 of 312

The bulk of Linux theft: Reading files

45

46 of 312

Or read(2)ing files

46

47 of 312

Or read(2)ing files

47

48 of 312

Or read(2)ing files

48

49 of 312

Or read(2)ing files - Argv

49

50 of 312

Or read(2)ing files - "The command"

50

51 of 312

Or read(2)ing files

51

52 of 312

Or read(2)ing files - open(2)

52

53 of 312

Or read(2)ing files - read(2)

53

54 of 312

Or read(2)ing files - The important part

54

55 of 312

openat(2) - Prep

55

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

​

rdi

Directory FD

​

rsi

*Pathname

​

rdx

Flags

​

You are here

56 of 312

openat(2) - Prep

56

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

​

rsi

*Pathname

​

rdx

Flags

​

You are here

57 of 312

openat(2) - Prep

57

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

​

rdx

Flags

​

You are here

58 of 312

openat(2) - Prep

58

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

0xOverHere

rdx

Flags

​

You are here

59 of 312

openat(2) - Prep

59

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

0xOverHere

rdx

Flags

​

You are here

60 of 312

openat(2) - Prep

60

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

0xOverHere

rdx

Flags

​

You are here

61 of 312

openat(2) - Prep

61

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

0xOverHere

rdx

Flags

O_RDONLY (0)

You are here

62 of 312

openat(2) - Kernel

62

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

0xOverHere

rdx

Flags

O_RDONLY (0)

Pid

FD

Inode

Device

​

​

​

​

You are here

63 of 312

openat(2) - Kernel

63

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

257

rdi

Directory FD

AT_FCWD (-100)

rsi

*Pathname

0xOverHere

rdx

Flags

O_RDONLY (0)

Pid

FD

Inode

Device

477234

3

1408718

0,20

You are here

64 of 312

openat(2) - Kernel

64

/proc/476982/environ\x00

Memory

Registers

rax

File Descriptor

3

rdi

​

​

rsi

​

​

rdx

​

​

Pid

FD

Inode

Device

477234

3

1408718

0,20

You are here

65 of 312

openat(2) - Return

65

/proc/476982/environ\x00

Memory

Registers

rax

File Descriptor

3

rdi

​

​

rsi

​

​

rdx

​

​

You are here

66 of 312

read(2) - Prep

66

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

​

rdi

FD

​

rsi

*Buffer

​

rdx

Size

​

You are here

67 of 312

read(2) - Prep

67

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

​

rsi

*Buffer

​

rdx

Size

​

You are here

68 of 312

read(2) - Prep

68

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

3

rsi

*Buffer

​

rdx

Size

​

You are here

69 of 312

read(2) - Prep

69

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

3

rsi

*Buffer

0xOverThere

rdx

Size

131072

You are here

70 of 312

read(2) - Prep

70

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

3

rsi

*Buffer

0xOverThere

rdx

Size

131072

You are here

71 of 312

read(2) - Prep

71

/proc/476982/environ\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

3

rsi

*Buffer

0xOverThere

rdx

Size

131072

You are here

72 of 312

read(2) - Return

72

/proc/476982/environ\x00

PATH=/home/wurzel/bin:/home/wurzel/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games\x00VULNERABLE_SERVER_PASSWORD=b6974f35b717c68ee1455840c884c4ac\x00SHELL=/bin/bash\x00PWD=/home/wurzel\x00LOGNAME=wurzel\x00XDG_SESSION_TYPE=tty\x00MOTD_SHOWN=pam\x00HOME=/home/wurzel\x00LANG=C.UTF-8\x00XDG_SESSION_CLASS=user\x00USER=wurzel\x00SHLVL=0\x00XDG_SESSION_ID=565\x00XDG_RUNTIME_DIR=/run/user/1000\x00DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\x00_=/home/wurzel/bin/vulnerableserver\x00

Memory

Registers

rax

Number of bytes read

454

rdi

​

​

rsi

​

​

rdx

​

​

You are here

73 of 312

write(2) - Prep

73

/proc/476982/environ\x00

PATH=/home/wurzel/bin:/home/wurzel/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games\x00VULNERABLE_SERVER_PASSWORD=b6974f35b717c68ee1455840c884c4ac\x00SHELL=/bin/bash\x00PWD=/home/wurzel\x00LOGNAME=wurzel\x00XDG_SESSION_TYPE=tty\x00MOTD_SHOWN=pam\x00HOME=/home/wurzel\x00LANG=C.UTF-8\x00XDG_SESSION_CLASS=user\x00USER=wurzel\x00SHLVL=0\x00XDG_SESSION_ID=456\x00XDG_RUNTIME_DIR=/run/user/1000\x00DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\x00_=/home/wurzel/bin/vulnerableserver\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

1

rsi

*Buffer

0xOverThere

rdx

Size

454

You are here

74 of 312

write(2) - Stdout

74

/proc/476982/environ\x00

PATH=/home/wurzel/bin:/home/wurzel/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games\x00VULNERABLE_SERVER_PASSWORD=b6974f35b717c68ee1455840c884c4ac\x00SHELL=/bin/bash\x00PWD=/home/wurzel\x00LOGNAME=wurzel\x00XDG_SESSION_TYPE=tty\x00MOTD_SHOWN=pam\x00HOME=/home/wurzel\x00LANG=C.UTF-8\x00XDG_SESSION_CLASS=user\x00USER=wurzel\x00SHLVL=0\x00XDG_SESSION_ID=456\x00XDG_RUNTIME_DIR=/run/user/1000\x00DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\x00_=/home/wurzel/bin/vulnerableserver\x00

Memory

Registers

rax

Syscall number

0

rdi

FD

1

rsi

*Buffer

0xOverThere

rdx

Size

454

You are here

75 of 312

write(2) - Return

75

/proc/476982/environ\x00

PATH=/home/wurzel/bin:/home/wurzel/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games\x00VULNERABLE_SERVER_PASSWORD=b6974f35b717c68ee1455840c884c4ac\x00SHELL=/bin/bash\x00PWD=/home/wurzel\x00LOGNAME=wurzel\x00XDG_SESSION_TYPE=tty\x00MOTD_SHOWN=pam\x00HOME=/home/wurzel\x00LANG=C.UTF-8\x00XDG_SESSION_CLASS=user\x00USER=wurzel\x00SHLVL=0\x00XDG_SESSION_ID=456\x00XDG_RUNTIME_DIR=/run/user/1000\x00DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\x00_=/home/wurzel/bin/vulnerableserver\x00

Memory

Registers

rax

Number of bytes written

454

rdi

​

​

rsi

​

​

rdx

​

​

76 of 312

write(2) - Return

76

/proc/476982/environ\x00

PATH=/home/wurzel/bin:/home/wurzel/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games\x00VULNERABLE_SERVER_PASSWORD=b6974f35b717c68ee1455840c884c4ac\x00SHELL=/bin/bash\x00PWD=/home/wurzel\x00LOGNAME=wurzel\x00XDG_SESSION_TYPE=tty\x00MOTD_SHOWN=pam\x00HOME=/home/wurzel\x00LANG=C.UTF-8\x00XDG_SESSION_CLASS=user\x00USER=wurzel\x00SHLVL=0\x00XDG_SESSION_ID=456\x00XDG_RUNTIME_DIR=/run/user/1000\x00DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus\x00_=/home/wurzel/bin/vulnerableserver\x00

Memory

Registers

rax

Number of bytes written

454

rdi

​

​

rsi

​

​

rdx

​

​

77 of 312

What are the system calls?

77

https://filippo.io/linux-syscall-table

78 of 312

It's programs/syscalls/turtles all the way down

78

79 of 312

It's programs/syscalls/turtles all the way down

79

80 of 312

It's programs/syscalls/turtles all the way down

80

81 of 312

It's programs/syscalls/turtles all the way down

81

82 of 312

It's programs/syscalls/turtles all the way down

82

83 of 312

It's programs/syscalls/turtles all the way down

83

84 of 312

It's programs/syscalls/turtles all the way down

84

85 of 312

It's programs/syscalls/turtles all the way down

85

86 of 312

It's programs/syscalls/turtles all the way down

86

87 of 312

It's programs/syscalls/turtles all the way down

87

88 of 312

It's programs/syscalls/turtles all the way down

88

89 of 312

It's programs/syscalls/turtles all the way down

89

90 of 312

It's programs/syscalls/turtles all the way down

90

91 of 312

It's programs/syscalls/turtles all the way down

91

92 of 312

It's programs/syscalls/turtles all the way down

92

93 of 312

It's programs/syscalls/turtles all the way down

93

94 of 312

Turtles are connected by pipes and file descriptors

94

95 of 312

Turtles are connected by pipes and file descriptors

95

96 of 312

Turtles are connected by pipes and file descriptors

96

97 of 312

Turtles are connected by pipes and file descriptors

97

98 of 312

Turtles are connected by pipes and file descriptors

98

99 of 312

Turtles are connected by pipes and file descriptors

99

100 of 312

Turtles are connected by pipes and file descriptors

100

101 of 312

Turtles are connected by pipes and file descriptors

101

102 of 312

Turtles are connected by pipes and file descriptors

102

103 of 312

Turtles are connected by pipes and file descriptors

103

104 of 312

Turtles are connected by pipes and file descriptors

104

105 of 312

Turtles are connected by pipes and file descriptors

105

106 of 312

Turtles are connected by pipes and file descriptors

106

107 of 312

Turtles are connected by pipes and file descriptors

107

108 of 312

Turtles are connected by pipes and file descriptors

108

109 of 312

Turtles are connected by pipes and file descriptors

109

110 of 312

Turtles are connected by pipes and file descriptors

110

111 of 312

Turtles are connected by pipes and file descriptors

111

112 of 312

Turtles are connected by pipes and file descriptors

112

113 of 312

Turtles are connected by pipes and file descriptors

113

114 of 312

Turtles are connected by pipes and file descriptors

114

115 of 312

Turtles are connected by pipes and file descriptors

115

116 of 312

Turtles are connected by pipes and file descriptors

116

117 of 312

Curlrevshell - Turtle Power!

117

Shell Stdout/Stderr via Curl

Syscalls

Cowabunga!!!

id

118 of 312

Aside: OpenBSD's ktrace(1)

118

119 of 312

Aside: OpenBSD's ktrace(1)

119

120 of 312

Aside: OpenBSD's ktrace(1)

120

121 of 312

Aside: OpenBSD's ktrace(1)

121

122 of 312

Aside: OpenBSD's ktrace(1)

122

123 of 312

Aside: OpenBSD's ktrace(1)

123

124 of 312

Aside: OpenBSD's ktrace(1)

124

125 of 312

perl -ne 's/.*proctitle=\"(.*)\"/\1/||

s/.*proctitle=(.*)/pack"H*",$1/e||s/.*//s;s/\0/ /g;' /var/log/audit/audit.log

125

Code: github.com/magisterquis/procrastinationedr

126 of 312

Regex in a trenchcoat

126

Code: github.com/magisterquis/procrastinationedr

127 of 312

That's the whole thing, no response actions

127

Code: github.com/magisterquis/procrastinationedr

128 of 312

ed(1)

128

129 of 312

The Blue Team's favorite* syscall: execve(2)

129

* This statement not endorsed by...

130 of 312

The Blue Team's favorite* syscall: execve(2)

130

* This statement not endorsed by...

131 of 312

The Blue Team's favorite* syscall: execve(2)

131

* This statement not endorsed by...

132 of 312

The Blue Team's favorite* syscall: execve(2)

132

* This statement not endorsed by...

133 of 312

The Blue Team's favorite* syscall: execve(2)

133

* This statement not endorsed by...

134 of 312

The Blue Team's favorite* syscall: execve(2)

134

* This statement not endorsed by...

135 of 312

The Blue Team's favorite* syscall: execve(2)

135

* This statement not endorsed by...

136 of 312

The Blue Team's favorite* syscall: execve(2)

136

* This statement not endorsed by...

137 of 312

The Blue Team's favorite* syscall: execve(2)

137

* ...well, anybody, really.

138 of 312

The Blue Team's favorite syscall: execve(2)

Screenshot: tail -n 20 /var/log/procrastinationedr.log

EDR is regex in a trenchcoat

Don't see the echos

which/type difference for echo

TODO: Delete this

​

​

138

139 of 312

That's quite enough not hacking for now

N is just N+1 with extra steps...

  1. Commands
  2. Shell Input
  3. Programs
    1. Shells are programs too
  4. System Calls
  5. Commands to the Kernel

139

140 of 312

That's quite enough not hacking for now

N is just N+1 with extra steps...

  • Commands
  • Shell Input
  • Programs
    • Shells are programs too
  • System Calls
  • Commands to the Kernel

140

tl;dr - We just want the right syscalls in the right order

141 of 312

H4x

141

142 of 312

Root -> SIGSTOP EDR

142

143 of 312

Root -> SIGSTOP EDR

143

144 of 312

Root -> SIGSTOP EDR

144

145 of 312

Root -> SIGSTOP EDR

145

146 of 312

Root -> SIGSTOP EDR

146

147 of 312

Root -> SIGSTOP EDR

147

148 of 312

Root -> SIGSTOP EDR

148

149 of 312

Root -> SIGSTOP EDR

149

150 of 312

Root -> SIGSTOP EDR

150

151 of 312

Root -> SIGSTOP EDR

151

152 of 312

Root -> SIGSTOP EDR

152

153 of 312

Visible data-grabbing - cat(1)/argv

153

154 of 312

Visible data-grabbing - cat(1)/argv

154

155 of 312

Visible data-grabbing - cat(1)/argv

155

156 of 312

Less-visible data-grabbing - cat(1), sneakier

156

157 of 312

Less-visible data-grabbing - cat(1), sneakier

157

158 of 312

Less-visible data-grabbing - cat(1), sneakier

158

159 of 312

Less-visible data-grabbing - cat(1)less file redirection

159

160 of 312

Less-visible data-grabbing - cat(1)less file redirection

160

161 of 312

Less-visible data-grabbing - cat(1)less file redirection

161

162 of 312

Less-visible data-grabbing - cat(1)less file redirection

162

163 of 312

Invisible data-grabbing - read(2) without execve(2)

163

164 of 312

Invisible data-grabbing - read(2) without execve(2)

164

165 of 312

Invisible data-grabbing - read(2) without execve(2)

165

166 of 312

Invisible data-grabbing - read(2) without execve(2)

166

167 of 312

Invisible data-grabbing - read(2) without execve(2)

167

168 of 312

Invisible data-grabbing - read(2) without execve(2)

168

169 of 312

Invisible data-grabbing - read(2) without execve(2)

169

170 of 312

Invisible data-grabbing - read(2) without execve(2)

170

171 of 312

Invisible data-grabbing - read(2) without execve(2)

171

172 of 312

Invisible data-grabbing - read(2) without execve(2)

172

173 of 312

Invisible data-grabbing - read(2) without execve(2)

173

174 of 312

Invisible data-grabbing - read(2) without execve(2)

174

175 of 312

Invisible data-grabbing - read(2) without execve(2)

175

176 of 312

Invisible data-processing - coreutils without execve(2)

176

177 of 312

Invisible data-processing - coreutils without execve(2)

177

178 of 312

Invisible data-processing - coreutils without execve(2)

178

179 of 312

Invisible data-processing - coreutils without execve(2)

179

180 of 312

Invisible data-processing - coreutils without execve(2)

180

181 of 312

Invisible data-processing - coreutils without execve(2)

181

182 of 312

Invisible data-processing - coreutils without execve(2)

182

183 of 312

Invisible data-processing - coreutils without execve(2)

183

184 of 312

curlrevshell -ctrl-i crs/ctrl-i

184

185 of 312

curlrevshell -ctrl-i crs/ctrl-i

185

186 of 312

Text streams are a universal interface, except NULs

186

187 of 312

Text streams are a universal interface, except NULs

187

188 of 312

Text streams are a universal interface, except NULs

188

189 of 312

Text streams are a universal interface, except NULs

189

190 of 312

Text streams are a universal interface, except NULs

190

191 of 312

Text streams are a universal interface, except NULs

191

192 of 312

Text streams are a universal interface, except NULs

192

193 of 312

Text streams are a universal interface, except NULs

193

194 of 312

Text streams are a universal interface, except NULs

194

195 of 312

Text streams are a universal interface, except NULs

195

196 of 312

Text streams are a universal interface, except NULs

196

197 of 312

Text streams are a universal interface, except NULs

197

198 of 312

Text streams are a universal interface, except NULs

198

199 of 312

Text streams are a universal interface, except NULs

199

200 of 312

Situational awareness with less ED(R?) awareness

200

201 of 312

Situational awareness with less ED(R?) awareness

201

202 of 312

Situational awareness with less ED(R?) awareness

202

203 of 312

Shell Gymnastics

A recap

  • We want the kernel to do things for us
  • The kernel will do whatever it gets a system call to do
  • Shell built-ins and external programs make system calls
  • EDR sees external programs

203

204 of 312

Shell Gymnastics

A recap

  • We want the kernel to do things for us
  • The kernel will do whatever it gets a system call to do
  • Shell built-ins and external programs make system calls
  • EDR sees external programs

204

tl;dr - We make syscalls, kernel does things

205 of 312

socket(2)/connect(2)/math/read(2)/write(2)

205

Math

Math

Shell Stdout/Stderr via TLS

Shell Stdin via TLS

Syscalls

206 of 312

We'll look at that curl thing later

206

207 of 312

We'll look at that curl thing later

207

208 of 312

We'll look at that curl thing later

208

209 of 312

Original curl

209

210 of 312

What the original curl did

210

211 of 312

What the original curl did but all pretty

211

212 of 312

What the original curl did but all pretty

212

213 of 312

What the original curl did but all pretty

213

214 of 312

What the original curl did but all pretty

214

215 of 312

What the original curl did but all pretty

215

216 of 312

What the original curl did but all pretty

216

217 of 312

Less-bad curl execve(2)

217

218 of 312

Less-bad curl execve(2)

218

219 of 312

Less-bad curl execve(2)

219

220 of 312

Less-bad curl execve(2)

220

221 of 312

Less-bad curl execve(2)

221

222 of 312

Less-bad curl execve(2)

222

223 of 312

Less-bad curl execve(2)

223

224 of 312

Less-bad curl execve(2)

224

225 of 312

Less-bad curl execve(2)

225

226 of 312

Less-bad curl execve(2)

226

227 of 312

Less-bad curl execve(2)

227

228 of 312

Less-bad curl execve(2)

228

229 of 312

Less-bad curl execve(2)

229

230 of 312

Less-bad curl execve(2)

230

231 of 312

Less-bad curl execve(2)

231

232 of 312

Less-bad curl execve(2)

232

233 of 312

Less-bad curl execve(2)

233

234 of 312

Less-bad curl execve(2)

234

235 of 312

Less-bad curl execve(2)

235

236 of 312

Less-bad curl execve(2)

236

237 of 312

Less-bad curl execve(2)

237

238 of 312

Less-bad curl execve(2)

238

239 of 312

Less-bad curl execve(2)

239

240 of 312

Less-bad curl execve(2)

240

241 of 312

Slightly more execve(2)

241

242 of 312

Slightly more execve(2)

242

243 of 312

Cat scan

243

244 of 312

Wow - Mrs. McMurray

244

245 of 312

Networking

Can you hear me now?

  1. Generally need network comms
  2. Not terribly picky, except...
    1. Require: math (encryption)
    2. Avoid: argv
  3. Everything else is target-dependent

245

246 of 312

Networking

Can you hear me now?

  • Generally need network comms
  • Not terribly picky, except...
    • Require: math (encryption)
    • Avoid: argv
  • Everything else is target-dependent

246

tl;dr - Kernel moves packets about, we're happy

247 of 312

Curlrevshell - The General Idea (again)

247

https://not-h4x.lol/$ID/o

https://not-h4x.lol/$ID/i

Syscalls

248 of 312

Curlrevshell - The General Idea (again)

248

Syscalls

249 of 312

Curlrevshell - Now with fewer Curls (and more Gophers)

249

Syscalls

250 of 312

Curlrevshell - Now with fewer Curls (and more Gophers)

250

https://not-h4x.lol/$ID/io

Syscalls

251 of 312

No custom code yet

251

252 of 312

No custom code yet

252

253 of 312

No custom code yet

253

254 of 312

No custom code yet

254

255 of 312

No custom code yet

255

256 of 312

No custom code yet

256

257 of 312

No custom code yet

257

258 of 312

No custom code yet

258

259 of 312

No custom code yet

259

260 of 312

No custom code yet

260

261 of 312

No custom code yet

261

262 of 312

Go is "easy" to compile

262

263 of 312

Go is "easy" to compile

263

264 of 312

Go is "easy" to compile

264

265 of 312

Go is "easy" to compile

265

266 of 312

Go is "easy" to compile

266

267 of 312

Uploading is just write(2)

267

268 of 312

Uploading is just write(2)

268

269 of 312

Uploading is just write(2)

269

270 of 312

Uploading is just write(2)

270

271 of 312

Uploading is just write(2)

271

272 of 312

Uploading is just write(2)

272

273 of 312

Uploading is just write(2)

273

274 of 312

Uploading is just write(2)

274

275 of 312

Uploading is just write(2)

275

276 of 312

Curlrevshell, the reverse bit

276

277 of 312

Curlrevshell, the reverse bit

277

278 of 312

Curlrevshell, the reverse bit

278

279 of 312

Curlrevshell, the reverse bit

279

280 of 312

Curlrevshell, the reverse bit

280

281 of 312

Curlrevshell, the reverse bit

281

282 of 312

Stealth is the eye of the EDR-holder

282

283 of 312

Stealth is the eye of the EDR-holder

283

284 of 312

On Linux, everything is a file (descriptor)

284

285 of 312

Memory we have mapped (mmap(2)'d)

285

286 of 312

Files we shouldn't have mapped

286

287 of 312

Files we shouldn't have mapped

287

288 of 312

The plan

288

289 of 312

The plan

289

mmap(2)

290 of 312

The plan

290

Temporary Buffer

291 of 312

The plan

291

Copy

Temporary Buffer

292 of 312

The plan

292

Temporary Buffer

mremap(2)

293 of 312

The plan

293

mremap(2)

294 of 312

The plan

294

Gone

295 of 312

Sneaky Remap

295

https://github.com/magisterquis/sneaky_remap

296 of 312

Sneaky Remap

296

https://github.com/magisterquis/sneaky_remap

297 of 312

Sneaky Remap

297

https://github.com/magisterquis/sneaky_remap

298 of 312

Sneaky Remap

298

https://github.com/magisterquis/sneaky_remap

299 of 312

Sneaky Remap

299

https://github.com/magisterquis/sneaky_remap

300 of 312

Activating the cloak of invisibility

300

301 of 312

Activating the cloak of invisibility

301

302 of 312

Activating the cloak of invisibility

302

303 of 312

Activating the cloak of invisibility

303

304 of 312

Activating the cloak of invisibility

304

305 of 312

Activating the cloak of invisibility

305

306 of 312

Sneakily remapped

306

307 of 312

Sneakily remapped

307

308 of 312

Sneakily remapped

308

309 of 312

tl;dr

One last time...

  1. Definitions
    1. Linux ops: A series of system calls plus monospaced text
    2. Stealth: Unnoticed system calls
    3. Easy Linux ops: System calls without being fussy about tooling
  2. 90% toolkit
    • Shell
    • Curl
  3. The other 10%
    • Whatever else works

309

310 of 312

tl;dr

One last time...

  • Definitions
    • Linux ops: A series of system calls plus monospaced text
    • Stealth: Unnoticed system calls
    • Easy Linux ops: System calls without being fussy about tooling
  • 90% toolkit
    • Shell
    • Curl
  • The other 10%
    • Whatever else works

310

tl;dr - The important thing is the syscalls

311 of 312

Thanks :)

Questions?

311

Code: github.com/magisterquis/lutlol

312 of 312

Thanks :)

No time for questions :(

312

Code: github.com/magisterquis/lutlol