[.LiT]

Adding Scripts to startup In Linux From the Command Line

Obviously this will be useful in everyday use or if you gained access to a remote machine (during a legal pen test of course)and you need to start you’re backdoor whenever the target computer boots

First create a bash script in the /etc/init.d directory which is a directory full of scripts that run when your Linux machine starts or turns off depending how they are set up.

I made a test script named test1 that just touches a file called lolcats.txt to the Desktop for testing purposes. Here is the contents of my test bash script:

#! /bin/bash
touch /home/lit/Desktop/lolcats.txt

Make the file an executable. Idk why but I made the file rwx for everyone , I just felt like it. I guess it would be best to set the files permissions for root writing only because we don’t want users without root privs to remove our malicious script.

chmod ugo+rwx /etc/init.d/test1

Now theres one more step to make the script start on boot. We need to make a link of the bash script from the rc2.d , rc3.d etc etc directories. The rc*.d directories contain symbolic links to the /etc/init.d startup script directory and are ran when the system boots up on certain run levels. The easiest way to make the symbolic link to our bash script is to link it to run for every run level. To do this issue the following command. “Defaults” will link the startup script to all run levels. test1 is the name of my script:

update-rc.d test1 defaults


Now every time my computer boots up a file is created on my desktop called lolcats.txt ... But of course instead of adding a .txt file to the desktop we can do much more malicious things like tell netcat to listen on a specific port number and then shovel a shell back to us when we connect.


You can also do this from GUI by going to system>preferences>startup applications and entering your commands there. But when pentesting we barely ever have a GUI of the compromised target computer to work with so doing it from the command line is the only option.

[.LiT]

Adding Scripts to startup In Linux From the Command Line

Obviously this will be useful in everyday use or if you gained access to a remote machine (during a legal pen test of course)and you need to start you’re backdoor whenever the target computer boots

First create a bash script in the /etc/init.d directory which is a directory full of scripts that run when your Linux machine starts or turns off depending how they are set up.

I made a test script named test1 that just touches a file called lolcats.txt to the Desktop for testing purposes. Here is the contents of my test bash script:

#! /bin/bash
touch /home/lit/Desktop/lolcats.txt

Make the file an executable. Idk why but I made the file rwx for everyone , I just felt like it. I guess it would be best to set the files permissions for root writing only because we don’t want users without root privs to remove our malicious script.

chmod ugo+rwx /etc/init.d/test1

Now theres one more step to make the script start on boot. We need to make a link of the bash script from the rc2.d , rc3.d etc etc directories. The rc*.d directories contain symbolic links to the /etc/init.d startup script directory and are ran when the system boots up on certain run levels. The easiest way to make the symbolic link to our bash script is to link it to run for every run level. To do this issue the following command. “Defaults” will link the startup script to all run levels. test1 is the name of my script:

update-rc.d test1 defaults


Now every time my computer boots up a file is created on my desktop called lolcats.txt ... But of course instead of adding a .txt file to the desktop we can do much more malicious things like tell netcat to listen on a specific port number and then shovel a shell back to us when we connect.


You can also do this from GUI by going to system>preferences>startup applications and entering your commands there. But when pentesting we barely ever have a GUI of the compromised target computer to work with so doing it from the command line is the only option.