Lesser Known Linux Persistence Mechanisms

This presentation explores both common and lesser-known Linux persistence mechanisms that adversaries use to maintain access to compromised systems 1:16, with the speaker explaining persistence as techniques used by attackers to maintain footholds and backdoors for ongoing access 1:42.

Key Takeaways:
• Beyond basic methods like SSH keys and cron jobs, SSH proxy commands can be configured in SSH config files to execute arbitrary commands during connections 11:45
• TCP wrapped services (/etc/hosts.allow and /etc/hosts.deny) can be exploited to trigger backdoors when specific services connect 13:00
• PAM (Pluggable Authentication Module) degradation attacks allow attackers to create backdoor authentication modules that accept universal passwords 14:28
• Userland rootkits like Prism can use ICMP traffic for covert command and control communications, bypassing typical network monitoring 16:48
• Linux kernel modules like Reptile can manipulate file system operations, forcing the kernel to return false data even when files are modified 18:06

The presentation concludes with mention of the Panics tool from Elastic, which provides a framework for testing and researching these persistence mechanisms 20:22.

Sources:

• 1:16 Introduction to Linux persistence mechanisms
• 1:42 Definition of persistence in context of MITRE ATT&CK
• 11:45 SSH proxy commands technique
• 13:00(https://www.yout