Persistence via ELF backdooring through codecave or new section

documentation/modules/exploit/linux/persistence/elf.md

@@ -0,0 +1,75 @@
+## Vulnerable Application
+
+This module targets writable Linux ELF executables. It supports little-endian
+x86, x64, and AArch64 ET_EXEC and ET_DYN files. It first tries to place the
+trampoline and payload in zero-filled padding after an executable PT_LOAD
+segment. If that is unsuitable, a PT_NULL or non-GNU-property PT_NOTE program
+header is reused for an added executable segment.
+
+Use a disposable copy of a standard executable when setting up a test target:
+
+```sh
+cp /bin/true /tmp/persistent-true
+chmod u+w /tmp/persistent-true
+```
+
+The module changes the executable PT_LOAD size or a reusable program header and
+the entry point, so signed or integrity-monitored executables are unsuitable
+targets.
+
+## Verification Steps
+
+1. Start a Linux meterpreter or shell session.
+1. Copy a compatible ELF to a writable location on the target.
+1. Start msfconsole.
+1. Do: `use exploit/linux/persistence/elf`
+1. Do: `set SESSION <session id>`
+1. Do: `set ELF_PATH /tmp/persistent-true`
+1. Select the target and payload matching the ELF architecture.
+1. Set the payload options, including `LHOST` and `LPORT` for a reverse payload.
+1. Do: `run`
+1. Launch `/tmp/persistent-true` on the target.
+1. The payload should connect while the original executable exits normally.
+
+## Options
+
+### ELF_PATH
+
+Absolute path of one existing ELF executable to modify. The file must be
+readable, writable, executable, and compatible with the selected target.
+
+### DisablePayloadHandler
+
+Set this advanced option to `true` to install the persistence without starting
+or waiting on a handler.
+
+### PrependExecOnce
+
+Set this payload advanced option to `true` to atomically create a randomized
+marker under `/dev/shm` and run the payload only when marker creation succeeds.
+The marker is normally cleared at reboot. `/dev/shm` must be writable by the
+account that launches the modified ELF.
+
+### CleanUpRc
+
+When enabled on a Meterpreter session, the module writes a cleanup resource
+file that restores the original ELF from the loot backup. Shell sessions still
+create the loot backup but do not create the resource file.
+
+## Targets
+
+Select `Linux x64`, `Linux x86`, or `Linux AArch64` to match the ELF file. The
+selected Metasploit payload must have the same native architecture.
+
+## Limitations
+
+The payload is only triggered when the modified ELF is executed. The module
+does not support shared objects without an entry point or big-endian ELFs. An
+ELF without enough executable segment padding needs a reusable PT_NULL or
+PT_NOTE program header. Code-cave injection preserves file size; segment
+injection can increase it. Both techniques change contents, the entry point,
+program headers, and integrity hashes while preserving the original file mode.
+
+## Scenarios
+
+Manual verification output must be supplied by the module contributor.