Exploring Linux Memory Manipulation for Stealth and Evasion
Carlos Polop and Javier Gutierrez demonstrate novel in-memory manipulation techniques on Linux to execute stealthy payloads within read-only and distroless containers.
Summary
Exploitation Challenges in Hardened Linux Environments
Modern container deployments increasingly utilize read-only root filesystems, `noexec` volume mounts, and minimal distroless base images to restrict attacker payload execution.
Manipulating Linux Memory Without Executable Disk Files
Carlos Polop and Javier Gutierrez explore advanced in-memory execution primitives, abusing `ptrace`, `/proc/self/mem`, and fileless shared memory file descriptors (`memfd_create`).
Process Injection and Runtime Code Patching
Step-by-step demonstrations illustrate how malicious implants can inject shellcode into running daemon memory spaces, hook dynamic symbols, and evade container security monitors.
Mitigations and Container Hardening
The authors discuss defensive countermeasures, including restricting `ptrace_scope`, deploying Seccomp system call filters, and implementing kernel-level memory integrity auditing.
Related talks
Main Stage·39 min
Rex Guo · Junyuan Zeng
Rex Guo and Junyuan Zeng present the Phantom Attack, exploiting implementation flaws in Linux system call tracing frameworks to completely blind endpoint monitoring agents.
Main Stage·41 min
Ron Ben-Yizhak · David Shandalov
Stealthy code injection technique using process shimming without registry modifications or on-disk SDB files.
Briefings·38 min
Shu-Hao Tung
Gaining initial access to an intranet is one of the most challenging parts of red teaming.