After compromising a Linux web server, a penetration tester wants to establish persistence without creating a new user account. Which technique would achieve this while remaining less visible to basic user account audits?

Question

Accepted Answer

A. Adding the tester's SSH public key to the root user's authorized_keys file. Adding an SSH public key to the root user's (or any existing user's) `authorized_keys` file allows the tester to authenticate via SSH using their private key without a password. This does not create a new user account and would be missed by audits that only check for new user accounts, making it a stealthier persistence mechanism.

After compromising a Linux web server, a penetration tester wants to establish persistence without creating a new user account. Which technique would achieve this while remaining less visible to basic user account audits?

Related Questions

Discussion