If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, what's the best way to preserve the executable and its state, and terminate the access?
The executable file itself is marked as deleted, so, it's not possible to simply make a copy of it. Additionally, since it appears that the
exe file within the respective
/proc/%d directory is merely a symlink, and the executable itself is not one of the files open within
/proc/%d/fd, it seems like even saving the executable file itself might be a bit tricky.
How do you save all states associated with the executable for future analysis, as well as the executable itself?