Question

During a Linux post-exploitation phase, you have a low-privilege shell on a build server via a reverse shell that dies whenever your SSH client disconnects or the parent process is reaped. You need your running enumeration tools and callback to survive session termination without installing new packages or triggering the host's file-integrity monitoring, which alerts on new files in /etc, /usr, and cron directories. Which approach best maintains your access under these constraints?

Accepted Answer

Detach the reverse shell into a backgrounded session using an already-present terminal multiplexer (tmux/screen) or wrap it with nohup and disown so it is not tied to the controlling terminal

Answer

Add a new SSH public key to /root/.ssh/authorized_keys so you can reconnect at will

Answer

Create a cron entry in /etc/cron.d that re-launches the reverse shell every minute

Answer

Write a systemd service unit under /etc/systemd/system that restarts the payload on boot