search

linux-persistence

hashtag
Lab 1 - SSH

🔬 Maintaining access Iarrow-up-right

  • Target IP: 192.3.140.3

  • Persistence via SSH Keys, even after user credentials are modified

  • Initial credentials: student :password

ip -br -c a
	192.3.140.2/24
ssh student@192.3.140.3

hashtag
SSH Keys

ls -al
    drwxr-xr-x 1 student student 4096 Apr 29 13:40 .
    drwxr-xr-x 1 root    root    4096 Apr 26  2019 ..
    -rw------- 1 student student    7 Apr 29 13:40 .bash_history
    drwx------ 2 student student 4096 Apr 29 13:39 .cache
    drwxr-xr-x 1 root    root    4096 Apr 26  2019 .ssh
    -rw-r--r-- 1 student student   91 Apr 26  2019 wait

cat wait
    Delete this file to trigger connection reset.
    Delete it only after planting the backdoor.

cd .ssh
ls
	authorized_keys  id_rsa

  • Show the private key inside id_rsa

hashtag
Persistence

  • Exit the SSH session and download the id_rsa file

  • Log back into the target system and trigger the password and connection reset

  • Connect to the target using the downloaded private key

chevron-rightReveal Flag: 🚩hashtag

689227a4f1b97afe1ff5ebaf85babc19

📌 Instead of using a user's private key, typically the attacker generates an SSH key pair on his system, keeps the private key on his system, transfers the public key onto the target system user's home .ssh directory and adds it in the authorized_keys file.

hashtag
Lab 2 - Cron Jobs

🔬 T1168: Local Job Schedulingarrow-up-right

hashtag
Cron Jobs

hashtag
Persistence

  • Create a new Cron job as the student user

    • The command inside the cron job will be executed with the student's permissions'

  • Log back into the target system and trigger the password and connection reset

  • Setup a nc listener and wait for the bash reverse shell from the cron job that runs every minute

chevron-rightReveal Flag: 🚩hashtag

79969e32981f722464fde4ce7f208883

Previouscrack-hashesNextlinux-post-exp

Last updated