PANIX - Customizable Linux Persistence Tool for Security R

项目说明

<p align="center">
<img src=" alt="PANIX logo"width="1010" height="750">
<h1 align="center"><a href=" - Persistence Against *NIX</a></h1>
</p>

![]()

PANIX is a powerful, modular, and highly customizable Linux persistence 框架 designed for security researchers, detection engineers, penetration testers, CTF enthusiasts, and more. Built with in mind, PANIX emphasizes functionality, making it an essential 工具 for understanding and implementing a wide range of persistence techniques.

![]()

Features

PANIX provides a suite of features for simulating and researching Linux persistence mechanisms.

| Feature | Description |Root|User|
|----------------------------------|-----------------------------------------------------------------------------------------|--------|--------|
| At Job Persistence | Implements persistence by adding entries to system jobs. | ✅ | ✅ |
| Authorized Keys | Adds a public key to the authorized_keys file for SSH access. | ✅ | ✅ |
| Backdoor User | Creates a backdoor user with UID=0 (root pri). | ✅ | ❌ |
| Backdoor System User | Backdoor a system user (SSH access to news/nobody). | ✅ | ❌ |
| Backdoored /etc/passwd | Directly adds a malicious user entry to /etc/passwd. | ✅ | ❌ |
| Backdoored /etc/init.d | Establishes persistence (/etc/init.d). | ✅ | ❌ |
| Backdoored /etc/rc.local | Establishes persistence via run control (/etc/rc.local). | ✅ | ❌ |
| Bind Shell | Runs a pre-compiled/LOLBin bind shell for remote access. | ✅ | ✅ |
| Capabilities Backdoor | Adds specific capabilities to binaries to maintain persistence. | ✅ | ❌ |
| Cron Job Persistence | Sets up cron jobs to ensure persistence across reboots. | ✅ | ✅ |
| Create User | Creates a new user account on the system. | ✅ | ❌ |
| D-Bus Backdoor | Creates a D-Bus service for root reverse shell access. | ✅ | ❌ |
| Diamorphine Rootkit | Installs the Diamorphine Loadable Kernel Module Rootkit. | ✅ | ❌ |
| Initramfs Persistence | Injects a UID=0 backdoor user into initramfs on reboot. | ✅ | ❌ |
| Git Persistence | Utilizes Git hooks or pagers to persist within Git repositories. | ✅ | ✅ |
| Generator Persistence | Le systemd generators to create persistent services. | ✅ | ❌ |
| GRUB Backdoor | Manipulates GRUB to execute a backdoor at boot. | ✅ | ❌ |
| Malicious Container | Deploys a Docker container designed to host escape. | ✅ | ✅ |
| Malicious Package | Installs a DPKG/RPM package to achie. | ✅ | ❌ |
| NetworkManager | Installs a dispatcher script to persist upon 网络 actions. | ✅ | ❌ |
| LD_PRELOAD Backdoor | Uses LD_PRELOAD to inject malicious libraries for persistence. | ✅ | ❌ |
| LKM Backdoor | Loads a Loadable Kernel Module to maintain persistence. | ✅ | ❌ |
| MOTD Backdoor | Alters Message of the Day (MOTD) to establish persistence. | ✅ | ❌ |
| Package Manager | Manipulates APT/YUM/DNF to establish persistence on usage. | ✅ | ❌ |
| PAM Persistence | Installs a PAM backdoor using a rogue module or pam_exec. | ✅ | ❌ |
| Password Change | Changes user passwords to secure backdoor accounts. | ✅ | ❌ |
| Polkit Backdoor | Creates an overly permissi configuration backdoor. | ✅ | ❌ |
| Reverse Shell | Establishes a reverse shell (supporting multiple LOLBins). | ✅ | ✅ |
| Shell Profile Persistence | Modifies shell profiles to execute scripts upon user login. | ✅ | ✅ |
| SSH Key Persistence | Manipulates SSH keys to maintain persistent access via SSH. | ✅ | ✅ |
| Sudoers Backdoor | Alters the /etc/sudoers file to grant elevated pri. | ✅ | ❌ |
| SUID Backdoor | Backdoors binaries by setting the SUID bit. | ✅ | ❌ |
| System Binary Backdoor | Wraps system binaries to include backdoor functionality. | ✅ | ❌ |
| Systemd Service | Creates systemd services that ensure persistence on reboot. | ✅ | ✅ |
| Ude | Utilizes drivers to persist at the hardware interaction level. | ✅ | ❌ |
| Web Shell Persistence | Deploys web servers for remote access via web interfaces. | ✅ | ✅ |
| XDG Autostart | Employs XDG autostart directories to persist upon user login. | ✅ | ✅ |

![]()

Support

PANIX offers comprehensi across Linux distributions.

| Distribution | Support | Tested |
|------------------|-----------|------------------------------------------------------------------|
| Debian | ✅ | Debian 11 & 12 |
| Ubuntu | ✅ | Ubuntu 22.04 (Diamorphine una) |
| RHEL | ✅ | RHEL 9 (MOTD & Pre-OS Boot techniques una) |
| CentOS | ✅ | CentOS Stream 9 & 7 (MOTD & Pre-OS Boot techniques una) |
| Fedora | ✅ | Not fully tested |
| Arch Linux | ✅ | Not fully tested |
| OpenSUSE | ✅ | Not fully tested |

Custom or outdated Linux distributions may ha configurations or lack specific features, causing mechanisms to fail on untested . If a default command fails, use the --custom flag a in most features to adjust paths and commands for your en. Review and modify the script to suit your needs if that doesn't resolve the issue.

Contributions via pull requests or issues for new features, updates, or ideas are always welcome!

![]()

Repository Structure

The PANIX repository is designed for modularity, maintainability, and ease of extension. Each persistence mechanism includes setup and revert scripts, simplifying management, and removal.

Key Benefits

Paired Setup & Revert: Every setup_*.sh has a corresponding revert_*.sh, ensuring easy removal of persistence mechanisms.

Modular Design: Easily modify existing modules or add new ones without affecting the core script.

Simple Expansion: To add new functionality:

1. Create a new setup_*.sh in modules/.
2. Add a corresponding revert_*.sh in modules/revert/.
3. Update main.sh to include the new scripts.
4. Update common.sh to include the module in the help menu.
4. Run build.sh to generate the updated panix.sh.

![]()

Getting Started

Getting PANIX up and running is as simple as downloading the script from the release page and executing it:

Or download it and execute it manually:

Executing the script will either show the root or user help menu, depending on the pri the current user has.

![]()

Examples

The script should be largely self-explanatory, however, this section will show a few examples of how to work with PANIX.

Help Menu

Every persistence mechanism has a separate help menu:

Every persistence mechanism also has an --examples flag that shows default and custom examples, aiding in crafting the command that works for you.

Execution

Most of the persistence mechanisms are very simple, and will (hopefully) not require much explanation. For example, systemd persistence can be set up simply through executing:

When setting up a persistence mechanism, the script will let you know whether it worked, and in cases where information is needed to work with the persistence mechanism, additional information is provided. For example the bind shell mechanism:

Allowing you to interact with the bind shell:

The same goes for mechanisms that ha built-in features such as the Docker persistence mechanism, with a built-in root host escape:

Which shows you exactly how to escape the container, and get access to the host.

Revert Mechanism

PANIX can clean its mess through the --revert command. Both for seperate modules:

And for all modules:

MITRE ATT&CK Matrix

PANIX has a built-in MITRE ATT&CK matrix that displays the techniques and sub-techniques a.

![]()

Publications and Resources

Publications in which PANIX is le:

Linux Detection Engineering - A Primer on Persistence Mechanisms

Linux Detection Engineering - A Sequel on Persistence Mechanisms

Linux Detection Engineering - A Continuation on Persistence Mechanisms

Linux Detection Engineering - Approaching the Summit on Persistence Mechanisms

Linux Detection Engineering - The Grand Finale on Linux Persistence Mechanisms

Feel free to check out my socials for updates on (Linux) security research.

<p align="left">
<a href=" src=" alt="Twitter"/></a>
<a href=" src=" alt="LinkedIn"/></a>
<a href=" src=" alt="Blog"/></a>
<a href=" src=" alt="GitHub"/></a>

![]()

Share

By sharing PANIX, you can assist others in testing and improving their security posture and support the de of new detection capabilities in Linux security.

![GitHub Repo stars]())
![GitHub Repo stars]()
![GitHub Repo stars]())
![GitHub Repo stars]()
![GitHub Repo stars]())

![]()

Disclaimer

PANIX is intended for authorized security testing and research purposes only. Misuse of this 工具 for malicious acti is not condoned and is entirely at the user's own risk. By using PANIX, you agree that you are responsible for your own actions. Just don't do stupid stuff.

项目信息

开发语言：Shell

Star 数：890

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Customizable Linux Persistence 工具 for Security Research and Detection Engineering.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。