Persistence, in one idea

They want to come back tomorrow

Breaking in once is not enough for an attacker. If the machine reboots, or you change the password, they are locked out again. So they set up something that runs by itself every time the machine starts. That is called persistence.

Think of a burglar who props a back window open so they can climb in again later without picking the lock. Your job is to walk around and find the propped-open windows.

On Linux, a common place for auto-start programs is systemd services. A service is just a small text file ending in .service. Here is what one looks like:

cat /tmp/sample.service

In the terminal

student@vulntech:~$ cat /tmp/sample.service
[Unit]
Description=Example service
[Service]
ExecStart=/usr/bin/sleep 3600
[Install]
WantedBy=multi-user.target

The line that matters to a defender is ExecStart= — that is the command the machine runs automatically. If it points somewhere strange, be suspicious.

Tip: Real service files live in /etc/systemd/system/. We will look there in the lab.