Description
This module injects a payload into an existing Linux ELF executable. The payload runs in a forked process whenever the executable is launched, while the original program continues from its original entry point.
The target must be a writable x86, x64, or AArch64 ET_EXEC or ET_DYN file with an executable code cave or a reusable PT_NOTE/PT_NULL program header. The original ELF is stored as loot before it is changed.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/persistence/elfmsf undefined(elf) > show actions ...actions...msf undefined(elf) > set ACTION < action-name >msf undefined(elf) > show options ...show and set options...msf undefined(elf) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
