Mathscantor's Cyber Journey
Step-by-Step Linux Process Injection Guide Part 6 - Unloading the Payload
How linworm stops its background worker and removes an injected shared library, either while the target keeps running or when the target exits.
Step-by-Step Linux Process Injection Guide Part 5 - Weaponizing Payloads
How linworm keeps a payload alive in the background with a thread and a sleep you can wake, then uses that to run a reverse shell, a beacon, and a memory patch.
Step-by-Step Linux Process Injection Guide Part 4 - Loading the Library
How linworm loads a shared library into a target process with malloc, ptrace_write, dlopen, and a constructor payload.
Step-by-Step Linux Process Injection Guide Part 3 - Shellcode and Remote Function Calls
How an injector places a trampoline shellcode into the target’s executable memory and uses it to call arbitrary functions remotely via ptrace register manipulation.
Step-by-Step Linux Process Injection Guide Part 2 - Attaching and Defeating ASLR
How to attach to a running process with ptrace, read /proc/pid/maps, and resolve libc function addresses in the target despite ASLR.