Consider I have root ssh access to a Linux server (Ubuntu 18.04 LTS). What is the best way to maintain access even after losing ssh access? Are there any tools out there to help maintaining stealthiness and access(root)?
This would be called 'persistence' both from perspective of automated malware and a human attacker.
Some popular approaches include:
- Extra user accounts - for example, creating an account 'hacker' with full suid privileges would allow to log in if the root credentials are changed;
- Backdoors - for example, a php webshell on a webserver, or a running CobaltStrike beacon, or a netcat bind shell listener would enable future access even if ssh becomes blocked as such. Also, downgrading some system service to an older version with known remote code execution vulnerabilities would be a useful backdoor.
- Scheduled tasks - for example, a cron job that runs a reverse shell every hour to an attacker-controlled adress, or a system startup script that adds an extra privileged account and backdoor when a system is restarted would enable to regain access at a later time if the attacker is kicked out.