Everybody welcome to the next video.
We're gonna be going over Linux persistence.
Now I want to show you just a few key ways to get to make yourself a little bit more persistent.
So now you've gained your initial shell so on this point we'll just assume that I have a shell on this
particular machine and we'll assume for now that it's not root.
So everything I'm about to show you for the next few.
I think one two or one two three different techniques the first three techniques are not route specific
but user specific.
And then the last two I want to go over is specific.
Now when you get on a box and you get your initial shell the first thing you want to do is gain persistence.
After you stabilize your machine or you stabilize your shell once you know you have a valid shell and
you can work with the system a little bit more dependably you're going to want to go ahead and set up
some sort of persistence.
Now persistence in this case is making sure that you can gain access to the machine again without having
to re exploit the entire machine just to gain another temporary shell.
So the first thing you want to do is take a look at the cron tab.
So on the user you could do cron tap Dash 8 and we'll this will go ahead and load this up for you.
So the way cron taps work is I'm not going to show you a exactly how to generate a cron tab.
However I'm going to show you how to make an entry in the crown tab for your user.
Now a cron tab is something that sets on us on a specific time so you can see in this example this is
these are the numbers right here that determine the time in which something will kick off and then this
is the command that gets executed as that user at that set of time.
So in this case it's at.
It looks like it's at 5:00 a.m. every week.
That's what that means.
So but we want to run as every five minutes.
So if we do star space slash five and then star star star star that sets up to run every five minutes
on THE DOT regardless of what time it is.
And that's a good amount of time for us to work with generating a payload and or having it kick back
the payload and run it so and then you would do you know half to binary
so that's all you would take.
And then as this user it would automatically every five minutes go ahead and relaunch your binary which
could be a maternity show could be you know for example you can run nat cat here so we can do that cat
was number of mostly on portfolio for she bin bash so we can do that as well.
So every five minutes it'll spot it'll try to start up a new process with a payload in the background.
So obviously if this is already running then it tries to open up it will try to run it again and try
to gain access to that and lock that port.
And it's no longer available.
So this is just one way that you can initially give yourself some persistence.
I want to show you guys next is modifying the bash C and bash profile.
Now some systems will have a bash on the score profile in their home directory.
So in your user's home directory you can do dot bash underscore profile.
So this is what it looks like on the profile on Cally as an example we don't have a batch profile we
have a batch or C on Max as an example you will have the bash profile they both produce the same result.
Essentially what the machine does is when you log in it loads up into the batch profile of the Bashar
c file and it goes ahead and executes whatever you have in there.
So if we go ahead and open this up and keep mine this is for a specific user one load this up you can
see it does have some basic stuff like the history file.
The term is being is being set.
So what we can do in here is just go all the way to the bottom or anywhere else we want and just tack
a line in to the bottom so we can just do echo.
Or we can do that cat again with some verbose import for four dash.
Then Bash but we want to kick it to the background.
Now this part's important because this is going to run like a standard bash script.
So if you do that you're gonna end up hanging the log in and that's very obvious.
So in this particular case we'll just kick it to the background and then the user will be none the wiser
unless they actually look at the processes that they've spot.
But this allows them to be able to you'd be able to gain that persistence.
Just one more extra way or this could be used to X to actually execute whatever binary you want it closes
and then bin or bash profile is done the exact same way it's the same concept.
Now we can always do something nice nice and simple so we can just do that cat listen for import 444
for Dash e bin bash and all you have to do is just kick it to the row.
Now this will work for net cat for one attempt.
So if you go ahead and lock in that attempt to connect to the machine get your shell and then when you
try to connect again it will fail.
So what you can do is you can write a quick bash script and have that consistently run on a loop in
it every little sleep for five seconds 10 seconds then it'll retry again and you can just launch that
bash script in the background instead so you can do payload sage and then run in the background as that
user from your net cat session.
So it runs in the background and every five seconds it will go ahead and make a new try to make a new
net connection.
So if you're connected nothing nothing occurs but if it fails you're good at what you can even do on
top of that before you kick in the background is put your standard error out to Dev No.
So that way you can hide any errors that go and approach.
So when you try to open reopen it after five seconds if you already connected in the SOC it's not available.
It will then go ahead and throw the error to have known set up to the user.
So now we've gone over some standard user ways but now I want to show you guys the
things you can do with root.
Now once you have root access to the machine the quickest way to gain persistence is just to add your
own user.
So if you user ad and then the name of the user we've gone ahead and added it.
So we're good there.
Now to set a password for it pass WD and then using it and then we'll just put password and password.
Now we've got a new user with a new password but we want to add it to the root groups and the user has
root access.
So that's user mod dash A.G. the group which is root and then the user.
That's it.
So we need to do so.
Go ahead and cat ATC pass the video.
We can see here are adding user is setup correctly so we're good.
So those are just a few ways to gain persistence but it's also important to understand which ones require
route and which ones don't.
The first view that I showed you you were able to gain access to the machine initially for the user
but not actually for route.
And in that case you can't create a user for example but there is one more thing I want to show you
guys is that you can create yourself a service that actually will start on startup.
Now how we do.
How do we do this.
There is a template above the video that you'll find that will give you a template for a service but
you'll need to make sure that you go ahead and modify the code.
The bash script there so that it's referencing your payload.
So on your on your compromised system again this has to be as route to install the service you're going
to go ahead and create a service in
C and D and then name it whatever you want.
So in this case will I named it Secret Service.
So if we're looking here it's not very complicated.
Essentially it's a giant switch statement but you can see here we have user local bin which is where
a binary is stored or this could be anywhere else you want it could be slash temp it doesn't matter.
So in this case we have our shell script and then we're giving it a secret API.
Which is fine.
This is all just standard.
So if we keep looking here these are what you're gonna have to modify.
THIS THIS THIS THIS THIS THIS.
NOW YOU CAN.
You can keep this all and just not echo anything here.
You can just go ahead and exit.
You can go ahead and exit this exits right away so you can go and not even bother to echo anything.
So it's entirely up to you.
But the point is is that you want to.
This is what actually kicks off your service.
The stopping in is less important.
So this is just a skeleton for service.
But your most important thing is on start this so I'll leave the link to this example above video but
once that's done you need to make sure that if you do go to your local bin that you're binary is in
here and it's executable and it's right.
So change mods 7 7 7 and then your actual executable.
Now again you can put this in Tampa doesn't matter as long as you reference it in your service and then
to kick it off.
It is ATC and it
D.
And then Secret Service and then you're going to go ahead if we do status
where you see it's not running.
So if we do start we can see boom we've gone ahead and should payloads set and that is because if we
look at our actual payload all we're doing is going out the text.
So we're good.
So we can also go ahead and stop it.
But since this is just a single command being ran and it exits out anyway there's nothing to really
stop.
But it tells the service process that it is indeed no longer running.
So these are just a few ways to gain persistence on a machine.
Go ahead and take a few minutes and review all of these actions and test it on your own killing machine
as well as go ahead and research at least an additional three or four more ways to gain persistence
on the Linux machine.