README.md

In-Memory Shellcode Detonator

A proof-of-concept Linux x86_64 loader that allocates RWX memory and executes raw shellcode entirely in memory, no disk artifacts, no staging files.

---

Executive Overview

Objectives & Use Cases

• Deliver a compact, single-stage loader for in-memory shellcode detonation.
• Validate defensive controls by demonstrating pure in-memory detonation techniques.

---

Technical Details

Core Features

• Memory Allocation (mmap): requests a private, anonymous RWX region for payload staging.
• Payload Injection: copies raw shellcode from a generated header (shellcode.h) into the allocated buffer.
• Direct Execution: casts buffer to a function pointer and transfers execution to shellcode.
• Minimal Syscalls: only mmap, memcpy, and invocation—no dynamic linking beyond standard C library.

Internal Components

├── shellcode_injector.c   – PoC stub loader (allocates, injects, executes)
├── shellcode             – raw shellcode (generated by msfvenom)
├── shellcode.h           – xxd-generated C header with byte array
└── linux_in-memory_shellcode-detonation_PoC  – compiled binary

Supported Platforms

• Linux x86_64 (glibc ≥ 2.17)
• Tested on Kali Linux 6.x kernel

---

Installation & Usage

Prerequisites

• Build Tools: gcc with C11 support, make (optional)
• Payload Generator: msfvenom from Metasploit Framework
• Payload Conversion: xxd to generate shellcode.h from raw bytes
• Permissions: ability to allocate RWX pages (no restrictive SELinux/AppArmor policies)

Build Steps

1. Generate Raw Shellcode

   msfvenom -p linux/x64/exec CMD="echo 'Hello World!'" -f raw -o shellcode

2. Convert to Header

   xxd -i shellcode > shellcode.h

3. Compile Loader

   gcc -std=c11 -Wall -Wextra -z execstack shellcode_injector.c -o linux_in-memory_shellcode-detonation_PoC

Execution Examples

• Detonate Payload

  ./linux_in-memory_shellcode-detonation_PoC

---

References

• Linux mmap(2) manual: https://man7.org/linux/man-pages/man2/mmap.2.html
• msfvenom documentation: https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit-Framework
• xxd(1) manual (hex dump utility): https://linux.die.net/man/1/xxd
• Executable space protection (NX bit) – https://en.wikipedia.org/wiki/Executable_space_protection
• MITRE ATT&CK T1055 – Process Injection - https://attack.mitre.org/techniques/T1055/
• MITRE ATT&CK T1564 – Hide Artifacts - https://attack.mitre.org/techniques/T1564/