Linux Persistence Mechanisms

You have achieved root access on a Linux server during an authorized penetration test. Evaluate and reason about persistence mechanisms.

**Cron & Scheduled Jobs**
- Where are cron jobs stored and which locations persist across user changes?
- How do you add a cron job for root that survives system reboots?
- What is the detection profile of a cron-based reverse shell?

**User & Authentication Persistence**
- How do you add a backdoor user that blends with existing accounts?
- What does modifying `/etc/passwd` and `/etc/shadow` allow you to do?
- How do SSH authorized_keys persistence work and why is it common?
- What is PAM and how can it be abused for credential capture?

**Service-Based Persistence**
- How do you create a malicious systemd service that auto-starts?
- What does a simple systemd unit file for a reverse shell look like?
- What are init.d scripts and do they still apply to modern Linux distributions?

**Binary & Library Hijacking**
- What is LD_PRELOAD hijacking and how can it be used for persistence?
- How does PATH hijacking work for privilege escalation and persistence combined?
- What is SUID binary replacement and what are its risks?

**Log Evasion**
- Where are authentication events logged on Linux?
- How do you modify timestamps and clean log entries?
- What does UTMP/WTMP record and how can it be manipulated?

Output:
- Persistence mechanism comparison: stealth vs. reliability vs. effort
- Detection artifacts per technique
- Systemd service unit file template for testing