Before we go, I want to share with you a few more resources in case you
want to learn more about pwncat and persistence. First, and most
important, check the official documentation from pwncat. In this course,
we covered just one of the features of the two, but the reality is that
pwncat has several other features like enumeration scripts and privilege
escalation modules.
Also, if you want to improve your red teaming game,
I recommend to you two courses here from Pluralsight. First, the
Persistence with Impacket course in which we cover another really
common persistent technique for writing engagements.
The other course I recommend is the Post Exploitation with
Meterpreter, which as the name suggests, covers all the activities
after getting initial access to a server.
Also, if you're wondering how you can protect your company against the
persistence attacks that we're discussing here, I have a few suggestions
for you. First, adopt security technologies that are able to monitor local
account changes. Attackers love to use SSH keys and hidden accounts to
create persistence in a server.
Also, you could adopt endpoint behavior defense tools to detect
the changes on local accounts and SSH files.
The attack that we performed here changes some critical SSH
files and a good behavior‑based tool would be able to detect
such changes. So that's it,
that's the end of our pwncat course. I hope you enjoyed this course and that
now you have one more persistence technique in your skillset. So thank you for
watching, and I'll see you in the next course.