The next few weeks will be a quick discussion on the different kinds of “job control” available, and how to potentially use them for persistence post compromise. This is an outside of the box type of thinking that is needed when hunting for “persistence” issues if you believe you’re machine has been compromised.
Before we get to job control “proper,” though, I wanted to walk down the top level (from an OS perspective) options, and that means we need to look at what happens when you boot your server. Typically there is a phase with some kind of power on self test, the BIOS or UEFI equivalent initializes hardware, then through magic smoke and mirrors finds and loads the boot loader. The boot loader loads the kernel and starts the init process.
There are attacks at the various hardware/firmware levels. We won’t look at those today. There are attacks at the boot loader level. We also won’t look at those today, though we may come back to this topic at a later date. A rootkit can replace your kernel, and we’re not going to look at those today, either. Instead, we’re going to start with “init” and work our way down from there. The techniques and topics we’ll cover are things that are “less intrusive” (since they don’t replace or modify firmware, the kernel, or user land programs to hide activity.)
The init system has several components, and depending on what “style” of init, are configured in different ways. We’ll briefly cover these pieces today, then go into detail on how to focus on any single component, later.
The first piece we’ll cover in more detail later is the ‘inittab’ component. This is a file that controls respawning of critical processes if they die, among other things.
The next piece is the ‘rc’ system. This includes SystemV style initialization scripts, systemd “units” (shudder,) and similar. There are many variations on this, but I’ll try to cover the most common SystemV, BSD, and systemd styles, and most systems will use some variation on these, so if you’re familiar with what I present, you should have little trouble picking up what’s going on with one that’s just similar to these, but not identical.
Finally, we’ll look at the ‘inetd’ or ‘xinetd’ systems, as well as the systemd equivalent.
After we get through the “init” system, we’ll continue the topics with actual job control and scheduling programs such as cron, at, and shell background jobs.