This is a PoC to a technique I found on X. This technique creates an anonymous process in the linux memory in run time and inject a payload then execute it.
Note: This code reads the targeted payload from the device disk with no decryption or any kind of obsfuscation methods. A more practical version will include obfuscation, and the payload should be fetched from the internet or embedded in the loader code
- Linux system
- GCC compiler installed
Download the code: git clone https://github.com/DarkLevelSecurity/elf_loader.git && cd elf_loader
Compile the loader: make loader
Compile the example: make example
then run the loader: ./elf_loader.out
You will notice a hacked_test.txt file is being created which was the job of the payload_example.elf file that the loader loaded to the memory.