Stealthy RCE on Hardened Linux: noexec + Userland Execution PoC

What was published

It has been reported that Hardened Linux published a detailed blog post and proof-of-concept showing how an attacker can run arbitrary ELF payloads from inside a compromised process without ever calling execve(2). The write-up, allegedly accompanied by a reusable library and demo code in src/, claims the technique leaves the original process name, PID and MAC context intact — so tools like ps and /proc//comm don’t scream “new exec.” Sysadmins who thought noexec mounts and SELinux/AppArmor were the last word might want to sit up.

How the technique works

In plain English: the loader parses an ELF in userspace, mmap()s or memfd_create+mmap()s the program segments into the current process, handles relocations and dynamic linking as needed, and then transfers control with a direct jump to the payload’s entry point. There’s a clever W^X signal-handler trick to get executable pages initialized without calling mprotect() in a way that trips policy engines; this signal-handler “dance” is central to the stealth. The post leans on a long-standing industry truism — once you’ve got arbitrary code execution in a process, kernel exec-path protections become largely moot — and it has been reported that the demo explicitly replicates this.

Why it matters

This isn’t academic hair-splitting. The emotional core of the report is blunt: defenses that rely on blocking execve or denying executable mounts can be theater if an attacker already controls a process’s memory. Want a one-liner? Noexec? What noexec. The practical takeaway is not to throw up your hands, but to rethink mitigations: reduce blast radius with strict privilege separation, use strong sandboxing that limits in-process capabilities, and focus on preventing the initial RCE and detecting anomalous in-process behavior.

The takeaway

The Hardened Linux post reads like a wake-up call from the underground — a reminder that defenders must assume in-process compromise and build layered, behavior-focused detection rather than relying solely on filesystem or exec-centric controls. The PoC’s release will likely prompt debate: patch the kernel, improve MAC hooks, or double down on prevention and detection? One thing’s clear: this piece adds fuel to the conversation, and defenders should take note — quickly.

Sources: hardenedlinux.org, Hacker News