Zombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs
summary
Explains how attackers load and assemble payloads entirely in memory using LD_PRELOAD, ELF constructors and weak symbols, and cross-process descriptors via memfd_create, turning trusted binaries like /bin/ls into decoys; introduces a memory-resident broker (Zombie Ant Farm) plus a Python “pi_preload” loader that fetches libraries over HTTP and injects them without touching disk; demonstrates chaining, FFI/VM switching, ASLR disable via personality flags, and live demos that successfully execute remote payloads in memory; toolkit is on GitHub.
AI-written summary · about
chapters (13)
- 0:00Start
- 7:54Tactical Goals and objectives, Sketches
- 9:00Dynamic Link Loading: The Basics
- 9:51The Basics of Dynamic Link Loading
- 10:40Dynamic ELF Hooking: The Basics
- 11:41Generic Dynamic API Hooking Tradeoffs
- 22:59Uber Preloaders
- 24:29Memory-resident malware modules
- 27:47Inspiration: A Natural phenomenon
- 29:58ZAF Module Loader and Payload Driver
- 31:42ZAF Broker Operational Summary
- 32:36PyPreload: Operationalizing Dynamic Preload Cradles
- 39:51Additional Tips and Research Roadmap
related talks
28mFileless Attack - Detecting the Undetectable
35mLet's Talk About the AI Apocalypse
40mAndroid Rootkits: Analysis from Userland and Kernelland
35mZombieLoad: Leaking Data on Intel CPUs
01h 00mIntroduction to memory exploitation
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."