Injection

Overview

This code was originally published in the first issue of tmp.0ut zine - an ELF Research Group founded by me and a super talented group of friends in early 2021. This project was finished literally minutes before the deadline we set. Living on the edge!

In general, it took me around a couple of months to complete it, most of the time was dedicated to its core infection routine since the auxiliary sections are common file I/O operations that I’m already familiar with. It was somewhat more challenging than Linux.Midrashim as the technique used here is not as trivial to implement and I want to thank everyone that helped me debug the final version. It was great to have those sessions with all of you, I learned a lot.

Overview

My interest in Assembly language started when I was a kid, mainly because of computer viruses of the DOS era. I’ve spent countless hours contemplating my first humble collection of source codes and samples (you can find it at https://github.com/guitmz/virii) and to me, it’s cool how flexible and creative one can get with Assembly, even if its learning curve is steep.

I’m an independant malware researcher and wrote this virus to learn and have fun, expanding my knowledge on the several ELF attack/defense techniques and Assembly in general.

Last month I wrote a [post](https://www.guitmz.com/running-elf-from-memory/) about the `memfd_create` syscall and left some ideas in the end. Today I'm here to show an example of such ideas implemented in an ELF runtime crypter (kinda lame, I know, but good for this demonstration).

What is it?

Glad you asked. Ezuri is a small Go crypter that uses AES to encrypt a given file and merges it with a stub that will decrypt and execute the file from memory (using the previously mentioned memfd_create syscall). My original goal was to write it in Assembly but that would require more time so it is a task for the future.

Something that always fascinated me was running code directly from memory. From [Process Hollowing](https://www.adlice.com/runpe-hide-code-behind-legit-process/) (aka RunPE) to `PTRACE` [injection](https://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/). I had some success playing around with it in `C` in the past, without using any of the previous mentioned methods, but unfortunately the code is lost somewhere in the forums of `VXHeavens` (sadly no longer online) but the code was buggy and worked only with Linux 32bit systems (I wish I knew about [shm_open](http://man7.org/linux/man-pages/man3/shm_open.3.html) back then, which is sort of an alternative for the syscall we are using in this post, mainly targeting older systems where `memfd_create` is not available).

Overview and code

Recently, I have been trying to code in assembly a bit, I find it very interesting and I believe every developer should understand at least the basics of it. I chose FASM as my assembler because I think it is very simple, powerful and I like its concepts (like same source, same output). More information about its design can be found here. Anyway, I have written a small tool, memrun, that allows you to run ELF files from memory using the memfd_create syscall, which is available in Linux where kernel version is >= 3.17.

Yup. That’s about it. Fascinating yet simple. I remember when I first read about this years ago and I was amazed (and still am!).