Question

During a Linux post-exploitation phase, you have root on a production application server and need durable persistence that survives reboots but remains low-profile. The client's rules of engagement require that all persistence mechanisms be documented and cleanly removable at engagement end. You are considering an LD_PRELOAD-based technique. Which approach best balances persistence, stealth, and the ability to fully restore the environment during cleanup?

Accepted Answer

Append a malicious shared object path to /etc/ld.so.preload, logging the original file state (or its absence) so it can be reverted exactly during cleanup

Answer

Recompile every system binary to statically link a backdoor, ensuring persistence even if libraries change

Answer

Replace /bin/bash with a wrapper script that spawns a reverse shell on each login and delete the original binary

Answer

Set an LD_PRELOAD variable in your current shell session only and rely on it for reboot persistence