Lesson 5.24: Sweeping for persistence
An attacker who wants to come back plants something that runs again on its own: a timer, a cron job, a login script, a package-manager hook, an SSH key. Linux has dozens of such places, and the useful ones for an attacker are the ones admins rarely read. In the lab Northwind's web server had an intruder on Saturday night. You sweep the usual persistence locations for files changed in that window, read each mechanism, keep copies with hashes, and remove them, including two that most checklists forget: an APT hook and a message-of-the-day script.
19 min
You will learn to
- List Linux persistence locations
- Sweep them for changes in a time window with find -newerct
- Read timers, APT hooks and update-motd scripts
- Spot an unknown SSH key
- Preserve, then remove persistence
Key terms
- Persistence
- Anything that lets an attacker regain access after a reboot, password change or cleanup.
- systemd timer
- A unit that starts a service on a schedule, like cron.
- APT hook
- A command APT runs before or after an operation, configured in /etc/apt/apt.conf.d.
- update-motd.d
- Scripts that build the login message; run as root at each interactive login.
- authorized_keys
- Public keys allowed to log in as that account.
- Sweep
- Checking every known location systematically rather than following hunches.
← The SSH client and the bastion · All lessons · Detecting a container breakout at runtime →