Ravindra BagaleCourses & study guides मराठी Track your progress

23. Exploitation with Metasploit

23.8 Persistence: How Attackers Keep Access

By Last updated:

Example first. In March 2021, attackers used new bugs in Microsoft Exchange email servers. On many servers they left a web shell, a small hidden web page that runs their commands. Many companies installed Microsoft's patch, but the web shells stayed. In April 2021, the FBI got a court order and removed web shells from hundreds of US servers. The patch closed the door, but it did not remove the key the attacker had already hidden.

Why it matters

Getting in is hard work for an attacker. They do not want to lose access when someone reboots the server, changes a password or patches the bug. So they set up a second, hidden way back in. If you clean only the first bug, they simply return.

What it is

Persistence means the tricks an attacker uses to keep access over time. In MITRE ATT&CK it is the tactic TA0003 (Chapter 31.9).

WordSimple meaning
Web shellA hidden script on a web server that runs the attacker's commands from a browser.
Cron jobA Linux task that runs on a schedule (Chapter 6.9).
authorized_keysThe file in ~/.ssh/ that lists SSH keys allowed to log in.
ServiceA program that starts by itself when the computer starts.
Backdoor accountA new user the attacker makes for themselves.
TrickLinux exampleWindows example
Run on a scheduleCron jobScheduled Task
Start at bootsystemd serviceNew service or Run key
Extra loginKey added to authorized_keysNew local admin user

How to find and remove it

  1. After any break-in, assume a backdoor exists. Do not stop at the first fix.
  2. List scheduled jobs: crontab -l and the files in /etc/cron.*.
  3. Check for new users and extra SSH keys in every ~/.ssh/authorized_keys.
  4. List services that start at boot and look for ones you do not know.
  5. Search the web folder for new or odd script files (possible web shells).
  6. When unsure, rebuild the server from a clean image and restore data only.

Worked examples

Worked example 1: A cron job that calls home

  1. The attacker adds a cron job that runs every 10 minutes.
  2. It connects out to the attacker's server and waits for commands.
  3. You find it with crontab -l and by reading /etc/crontab.
  4. Remove the line, then find how it was added in the first place.

Worked example 2: An extra SSH key

The safest login looks normal, so this one is easy to miss.

# list every SSH key trusted on the server
sudo find / -name authorized_keys 2>/dev/null \
  | while read f; do echo "== $f"; cat "$f"; done

Any key you do not recognise is a backdoor. Remove that line and change real keys.

Worked example 3: A web shell

  1. A new file like shell.php appears in the website folder.
  2. It runs system commands from a browser.
  3. Find recently changed files: find /var/www -mtime -7 -name '*.php'.
  4. Remove it, then patch the bug that let them upload it.

Real incident: Microsoft Exchange web shells (2021)

1. What happened

In early 2021, attackers used four new bugs (called ProxyLogon) in Microsoft Exchange email servers. Tens of thousands of servers worldwide were hit. On many, the attackers left web shells for later access.

2. How it happened

  1. The attackers used the bugs to run commands on the server.
  2. They dropped a small web shell into the web folder.
  3. Even after the patch, the web shell still gave them a way back in.

3. How to stop it

  1. Patch fast, but also hunt for what the attacker left behind.
  2. Look for new files in web folders and new scheduled jobs.
  3. When in doubt, rebuild the server clean.

In short

  • Persistence = the attacker's hidden way back in.
  • Common tricks: cron jobs, new users, extra SSH keys, services and web shells.
  • A patch or password reset alone does not remove it.
  • Hunt for leftovers, or rebuild the server from a clean image.