BOF implementation of delete self poc that delete a locked executable or a currently running file from disk by its pid, path, or the current process.
git clone https://github.com/AgeloVito/self_delete_bof.git
make
And load self_delete.cna
beacon> help self_delete
Use: self_delete [pid|path]
e.g: self_delete
self_delete 7956
self_delete /path/file.exe
self_delete
![image](https://private-user-images.githubusercontent.com/9564171/255414736-7507a649-a074-4e15-a439-69dc5f5dca22.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MDkzOTEsIm5iZiI6MTcyMTcwOTA5MSwicGF0aCI6Ii85NTY0MTcxLzI1NTQxNDczNi03NTA3YTY0OS1hMDc0LTRlMTUtYTQzOS02OWRjNWY1ZGNhMjIucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDcyMyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA3MjNUMDQzMTMxWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9MmQ3NTgzNGRhNGJmMDgxOWVkZTlhOTM2OTkxZDhhOTEwMDdhZmYyMzBjZTA2NDFhOTQxZDI4NjljYmUzOGQ4ZSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.THE30FPen07OztuzaegKjzpHQdI5drbHI9hiRRkCjxY)
self_delete by path
![image](https://private-user-images.githubusercontent.com/9564171/255415063-e3703f74-2a5d-46b0-81f8-39c2e9a25442.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MDkzOTEsIm5iZiI6MTcyMTcwOTA5MSwicGF0aCI6Ii85NTY0MTcxLzI1NTQxNTA2My1lMzcwM2Y3NC0yYTVkLTQ2YjAtODFmOC0zOWMyZTlhMjU0NDIucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDcyMyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA3MjNUMDQzMTMxWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9Mjk2MDgzNmYyOWY0MjRkOWJiYjczZjc2OTIyODg4ZWU2ZDk4NjMzZTAyMGY5MDc1MjYzZWI4NDFjNWZjOWZiMSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.wardZBtCZ3MVFXZ6EdAOpCnjnYNDUUAYUD-31SeG9rc)
self_delete by pid
![image](https://private-user-images.githubusercontent.com/9564171/255415451-8731b2ef-a6e6-48b3-bd78-e735d87b7ca7.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MDkzOTEsIm5iZiI6MTcyMTcwOTA5MSwicGF0aCI6Ii85NTY0MTcxLzI1NTQxNTQ1MS04NzMxYjJlZi1hNmU2LTQ4YjMtYmQ3OC1lNzM1ZDg3YjdjYTcucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDcyMyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA3MjNUMDQzMTMxWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9YzA5YTBhZDNkYzcxYWRmZDJmMzIzMTQ1NTcxNTE2M2RmMjE3YTEzNDI0NWI5YjY1ODE5MmJmNzVkNTk5NGQyNCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.q2HfYIBSZJeTB3dFNDBnqrv_xvhzs2dwimN-JwYW65c)
x86 process without manifest
![image](https://private-user-images.githubusercontent.com/9564171/255416131-32aedc7d-8688-4efa-8beb-2c1e892dc134.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MDkzOTEsIm5iZiI6MTcyMTcwOTA5MSwicGF0aCI6Ii85NTY0MTcxLzI1NTQxNjEzMS0zMmFlZGM3ZC04Njg4LTRlZmEtOGJlYi0yYzFlODkyZGMxMzQucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDcyMyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA3MjNUMDQzMTMxWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9ODM2NDFiM2M1ZTZjYzJlNzRiZDk2OTY1MDYwMDZmZTFlZmM5NjEyYTVlOWJlY2UzYWExNjIzMGI3ODhhZDBhZiZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.GzaQufnypcHymiVVSw5jPPjrUPSc6uQ0n6sR2_rPYDQ)
https://stackoverflow.com/questions/71834608/