forensicsmedium

PersistenceIsFutile

HackTheBox

Task: compromised Linux server with 8 backdoors (remote access + privilege escalation) to find and remove, then run verification script. Solution: systematic enumeration of SSH keys, crontabs, SUID binaries, shell RC files, MOTD scripts, and system users to identify and remediate all 8 persistence mechanisms.

$ ls tags/ techniques/

base64 suid privilege_escalation backdoor netcat reverse_shell incident_response persistence linux_forensics ssh_authorized_keys crontab bind_shell bashrc motd dns_c2

backdoor_enumeration_and_removalsuid_binary_detection_via_md5cron_persistence_analysisbashrc_alias_backdoor_detectionmotd_script_analysisssh_key_persistence_removaldns_txt_c2_detectionpasswd_shadow_modification_detection

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]