linux-persistence: Demonstrate Linux Persistence Techniques

Overview

linux-persistence is a Go-based security research project that demonstrates multiple ways persistence and covert access can be established on Linux systems. It is intended for authorized testing and education, rather than routine system administration.

The project may help security teams understand persistence risks and plan detection exercises in controlled environments. Its README describes potentially harmful capabilities, including credential capture and backdoor access, so use should be limited to isolated systems with explicit authorization.

Key Features

• Describes reverse-shell and network-listener mechanisms.
• Covers persistence through scheduled tasks and hidden files.
• Includes examples involving PAM, setuid binaries, and kernel modules.
• Describes ICMP, DNS, and port-reuse communication methods.
• Includes detection suggestions involving processes, network connections, scheduled tasks, and kernel modules.

Use Cases

• Security educators can use the project as a discussion aid for Linux persistence risks.
• Authorized red teams can assess whether monitoring detects persistence mechanisms in a controlled environment.
• Blue teams can use the README's technique categories to inform detection reviews and incident-response exercises.
• Security researchers can examine the project as a catalog of potentially harmful techniques without deploying it on systems they do not own or have permission to test.

Project Facts

• Language: Go
• Stars: 35
• Forks: 6
• Archived: No

Getting Started

Review the repository README before considering any testing. It describes the project’s requirements and usage; only evaluate it in an isolated environment where you have explicit authorization.

Considerations

• The README describes backdoors, covert access, and credential-capture behavior. Running such code can compromise systems and expose sensitive information.
• The README lists dependencies including GCC, Linux kernel development headers, PAM development libraries, and iptables. Some techniques require elevated privileges or system-level changes.
• The repository was created and last pushed on 2025-08-19, and the input reports one open issue. These facts do not establish how complete or reliable the implementation is.
• No license is specified in the provided repository data. The README’s educational-use notice is not a formal license grant.