Linux persistence techniques

[jvoisin]

In the same spirit than #16791, but for Linux:

Package managers

• Yum package manager persistence, in ./exploits/linux/local/yum_package_manager_persistence.rb
• Apt package manager persistence, in ./exploits/linux/local/apt_package_manager_persistence.rb
• apk

Service managers and autostart

• systemd service persistence, in ./exploits/linux/local/service_persistence.rb
• systemd user service persistence, in ./exploits/linux/local/service_persistence.rb
• sys-v service persistence, in ./exploits/linux/local/service_persistence.rb
• upstart service persistence, in ./exploits/linux/local/service_persistence.rb
• openrc service persistence Add openrc to exploits/linux/local/service_persistence.rb #19480
• rc.local persistence, in ./exploits/linux/local/rc_local_persistence.rb
• desktop autostart, in ./exploits/linux/local/autostart_persistence.rb

Misc

• at job persistence, in ./exploits/unix/local/at_persistence.rb
• SSH key persistence, in ./post/linux/manage/sshkey_persistence.rb
• crontab persistence, in ./exploits/linux/local/cron_persistence.rb
• bash profile, in ./exploits/linux/local/bash_profile_persistence.rb
• MOTD persistence, via /etc/update-motd.d/… Add modules/exploits/linux/local/motd_persistence.rb #19454
• udev backdoor, via /etc/udev/rules.d/, as used by the sedexp malware Add modules/exploits/linux/local/udev_persistence.rb #19472
• LD_PRELOAD

Resources:

• https://github.com/Aegrah/PANIX