4 ms·
Perhaps one simple way would be moving its own executable and putting a different executable in its path. The idea is that under Linux you can change things in
by _nalply 2y ago
Perhaps one simple way would be moving its own executable and putting a different executable in its path. The idea is that under Linux you can change things in the filesystem but the running process is keeping the old state. This way you can delete files but the process still has access to the file as long as it runs. This is exploited by log rotating: move the current log file and put a new log file in its place. Then when the service restarts it switches to the new log file, but not before.
Didn't try it out.
- TheDong 2y agoIt's obviously not that, as the article mentions, if you delete yourself, the /proc/$pid/exec link becomes: /proc/5868/exe -> '/home/user/main (deleted)' Since the author in the article acknowledged that, it seems clear to me that they weren't talking about deleting the exe, but instead something to do with PR_SET_MM_EXE_FILE.