LinuxKeeperGo

Advanced Linux Persistence Tool written in Go.

Features

• System environment detection
• Multiple persistence methods
• Automated payload generation
• Support for various Linux distributions

Installation

git clone https://github.com/10cks/LinuxKeeperGo
cd LinuxKeeperGo
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -a -trimpath -ldflags '-w -s -extldflags "-static"' -o LinuxKeeperGo ./cmd/main.go

Usage

 _ _ _ __ ____
|| (_)_ __ _ ___ _||/ /___ ___ _ __ ___ _ / ___| ___
||||'_ \| | | \ \/ / ' // _ \/ _ \ '_ \ / _ \ | | _ / _ \ | |___| | | | | |_| |> <| . \ __/ __/ |_) | __/ | |_| | (_) | |_____|_|_| |_|\__,_/_/\_\_|\_\___|\___| .__/ \___| \____|\___/ |_| [*] Linux Persistence Tool - Written in Go [*] Author: 10cks [*] Github: https://github.com/10cks/LinuxKeeperGo [*] Version: 1.0.0[*] System Check Results:---------------->Privilege<-----------------uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),116(netdev),1001(docker)----------->Backdoor Check<-------------OpenSSH后门[只测试过 Ubuntu 14 版本成功][x] SSH后门用户[√] Alerts后门计划任务后门 [x] /etc/crontab [√] /var/spool/cron/ubuntu [√] /var/spool/cron/crontabs[x] SSH软链接后门 [如果是root权限，可以直接SSH软链接模块运行开启][√] SSH公私密钥后门 没有权限修改sshd_config文件[√] Strace后门[x] Rootkit后门计划任务&SSH软链接后门 [x] /etc/crontab [√] /var/spool/cron/ubuntu [√] /var/spool/cron/crontabs计划任务&SSH Key后门 [x] /etc/crontab [√] /var/spool/cron/ubuntu [√] /var/spool/cron/crontabs [x] /etc/ssh/sshd_config------------------->Env<--------------------[x] PHP[x] Kubernetes[x] Rust[√] C++[x] Python2[√] Python3[x] Java[√] DockerUsage: -m <number> Select and execute a module -c <1|2> Show module information -l List all available modules -h Show this help message

Current Modules

[1] [root] SSH Backdoor - Create SSH backdoor with custom port

[2] [user/root] Crontab Backdoor - Create persistent crontab backdoor

Demo

ssh module

参考项目：

https://github.com/RuoJi6/HackerPermKeeper