Linux persistence techniques: systemd, cron, and shared objects

// Understanding systemd for persistence

Systemd has become the default init system on many Linux distributions, making it a prime target for persistence mechanisms. By creating a service unit file, a malicious actor can ensure their payload runs at system startup.

Create a malicious systemd service

Here’s a simple example of how to create a persistence mechanism using systemd:

# Create a service file in /etc/systemd/system
sudo nano /etc/systemd/system/malicious.service

Populate the file with:

[Unit]
Description=Malicious Service

[Service]
ExecStart=/usr/bin/malicious_payload
Restart=always

[Install]
WantedBy=multi-user.target

• Description: Clearly describes what the service does.
• ExecStart: Path to the payload that should execute. This can be a script or binary.
• Restart: Ensures the service restarts on failure, improving chances of persistence.
• WantedBy: Indicates when to start the service, with multi-user.target being the typical runlevel.

To enable and start the service:

sudo systemctl enable malicious.service
sudo systemctl start malicious.service

Detection of malicious systemd services

To identify potential persistence mechanisms via systemd, check for unrecognized services:

systemctl list-units --type=service --state=running

Look for anomalies like unusual names, unexpected paths in ExecStart, or services that restart frequently. Additionally, a well-configured auditd can provide insights into the creation and modification of service files:

auditctl -w /etc/systemd/system/malicious.service -p wa

• This command monitors the specified service file for write and attribute changes.

// Leveraging cron for persistence

Cron jobs are another routine mechanism that can be exploited for persistence. Malicious users can schedule tasks that invoke payloads regularly.

Create a malicious cron job

To create a cron job that runs a payload every minute:

crontab -e

Add the following line:

* * * * * /usr/bin/malicious_payload

Detection of malicious cron entries

To detect suspicious cron jobs, inspect the crontab for all users:

for user in $(cut -f1 -d: /etc/passwd); do echo "Crontab for $user:"; crontab -l -u $user; done

Examine the output for anomalies, such as jobs running unexpected executables or those with unusual permissions.

// Shared object tricks for persistence

Shared libraries can also be manipulated for persistence. By placing a malicious .so file in a directory that is in the library path, or modifying existing libraries, an attacker can hijack legitimate processes.

Creating a malicious shared object

1. Write a simple C program:

#include <stdio.h>
#include <stdlib.h>

void __attribute__((constructor)) init() {
    system("/usr/bin/malicious_payload");
}

2. Compile it into a shared object:

gcc -shared -o malicious.so -fPIC malicious.c

3. Place it in a directory like /usr/local/lib/ and update the cache:

sudo cp malicious.so /usr/local/lib/
sudo ldconfig

Detection of malicious shared objects

To check for unauthorized shared objects, use:

find /usr/local/lib -name '*.so' -exec ldd {} \; | grep malicious

Look for unexpected outputs that indicate the presence of malicious files. Additionally, employing integrity monitoring tools can detect unauthorized changes to shared objects.

// Workflow for detecting persistence mechanisms

• Audit systemd services: Regularly review running services using systemctl list-units.
• Inspect cron jobs: Periodically check all users' crontabs and scheduled jobs for anomalies.
• Monitor shared libraries: Use find and ldd to identify unexpected shared object files in library paths.
• Implement auditd: Set up monitoring on critical files and directories to catch unauthorized changes.
• Regularly update awareness: Stay abreast of the latest persistence techniques and detection measures.

Conclusion

Understanding and detecting persistence mechanisms on Linux requires a multifaceted approach that incorporates knowledge of systemd, cron, and shared libraries. Regular audits and monitoring can help identify these techniques before they can be exploited. All techniques discussed belong in a disposable range that you control, and further exploration can be found in the DaemonCore Academy curriculum.