Add systemd-tmpfiles.d persistence module (issue #36) - #41
Open
Diogo-Damasceno wants to merge 1 commit into
Open
Add systemd-tmpfiles.d persistence module (issue #36)#41Diogo-Damasceno wants to merge 1 commit into
Diogo-Damasceno wants to merge 1 commit into
Conversation
Implements persistence via systemd-tmpfiles.d as requested in Aegrah#36. - New module modules/setup_tmpfiles.sh (setup_tmpfiles): drops a payload file and a tmpfiles.d unit ('f <dest> 0644 root root - <payload>') that recreates the destination whenever it is deleted, giving a self-healing persistence primitive. Supports --default (reverse shell ip/port) and --custom (payload/dest/conf/command). Runs 'systemd-tmpfiles --create' to apply. - New module modules/revert/revert_tmpfiles.sh (revert_tmpfiles): removes the conf, the re-created file and the payload. - Registered --tmpfiles in main.sh dispatch + help, in modules/common.sh help and the revert-all module list. - Regenerated panix.sh via build.sh. Verified on Arch Linux: --default created /etc/tmpfiles.d/panix-persist.conf, /usr/local/lib/.cache/.payload and /etc/profile.d/panix-persist.sh; deleting the profile.d file and running 'systemd-tmpfiles --create' recreated it (self-heal); '--revert tmpfiles' removed all three artifacts. 'bash -n panix.sh' clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements persistence via
systemd-tmpfiles.das requested in #36.What it does
setup_tmpfilesmodule: drops a payload file and a tmpfiles.d unit(
f <dest> 0644 root root - <payload>) that recreates the destination filewhenever it is deleted — a self-healing persistence primitive. Supports
--default(reverse-shell ip/port written to a profile.d payload) and--custom(payload/dest/conf/command). Applies withsystemd-tmpfiles --create.revert_tmpfilesmodule: removes the conf, the re-created file and the payload.--tmpfilesin themain.shdispatch + help, inmodules/common.shhelp and the revert-all module list.
panix.shregenerated viabuild.sh.Verification (real, on Arch Linux)
--default --ip 10.10.10.10 --port 1337created/etc/tmpfiles.d/panix-persist.conf,/usr/local/lib/.cache/.payloadand/etc/profile.d/panix-persist.sh.systemd-tmpfiles --create <conf>recreated it (self-heal confirmed).--revert tmpfilesremoved all three artifacts.bash -n panix.shclean.Note
This is a red-team / adversary-emulation tool; the technique is documented public MITRE ATT&CK behaviour (T1053-adjacent / tmpfiles abuse). Files are written under
/etcand require root, matching every other PANIX module.