ariary / fileless-xec

Stealth dropper executing remote binaries without dropping them on disk .(HTTP3 support, ICMP support, invisible tracks, cross-platform,...)

«It's not a bug it's a feature»
If the feature works in an unintended way, it's a bug.

fileless-xec's Issues

Feature: fileless-xec in server mode (wait on target machine)

fileless-xec is used on target machine to execute a binary file on attacker controlled machine

From now, attacker machine runs a server which hosts binary file and fileless-xec request it then execute it

An interesting feature could be to have another type of interaction between target and attacker machine:
target machine would have a server (upload binarys server) and attacker machine will send the binary ( trough http, http3, ...) to the server. Once the binary file received the target machine execute it as usual.

Feature: pass argument to binary execution

Feature: support for Windows & system w/o memfd_create syscall

Although fileless-xec is made for stealthiness which mainly stands on memfd_create syscall (make it fileless), it could be interesting to have an option the store the binary file locally before execute it.

This will make fileless-xec useful for:

• Target machine which is windows one
• Target machine without memfd_create syscall
• Other cases where fileless functionalityis not needed

feature: self deleting executable

Have a flag to delete the running fileless-xec

Persistance or timeout option?

Have a way to schedule the launch of fileless-xec
Crontab or just a sleep ?