PANIX - Persistence Against *NIX

PANIX is a powerful, modular, and highly customizable Linux persistence framework designed for security researchers, detection engineers, penetration testers, CTF enthusiasts, and more. Built with versatility in mind, PANIX emphasizes functionality, making it an essential tool for understanding and implementing a wide range of persistence techniques.

Features

PANIX provides a versatile suite of features for simulating and researching Linux persistence mechanisms.

Feature	Description	Root	User
At Job Persistence	Implements persistence by adding entries to system jobs.	✅	✅
Authorized Keys	Adds a public key to the authorized_keys file for SSH access.	✅	✅
Backdoor User	Creates a backdoor user with UID=0 (root privileges).	✅	❌
Backdoor System User	Backdoor a system user (SSH access to news/nobody).	✅	❌
Backdoored /etc/passwd	Directly adds a malicious user entry to /etc/passwd.	✅	❌
Backdoored /etc/init.d	Establishes persistence via SysVinit (/etc/init.d).	✅	❌
Backdoored /etc/rc.local	Establishes persistence via run control (/etc/rc.local).	✅	❌
Bind Shell	Runs a pre-compiled/LOLBin bind shell for remote access.	✅	✅
Capabilities Backdoor	Adds specific capabilities to binaries to maintain persistence.	✅	❌
Cron Job Persistence	Sets up cron jobs to ensure persistence across reboots.	✅	✅
Create User	Creates a new user account on the system.	✅	❌
D-Bus Backdoor	Creates a D-Bus service for root reverse shell access.	✅	❌
Diamorphine Rootkit	Installs the Diamorphine Loadable Kernel Module Rootkit.	✅	❌
Initramfs Persistence	Injects a UID=0 backdoor user into initramfs on reboot.	✅	❌
Git Persistence	Utilizes Git hooks or pagers to persist within Git repositories.	✅	✅
Generator Persistence	Leverages systemd generators to create persistent services.	✅	❌
GRUB Backdoor	Manipulates GRUB to execute a backdoor at boot.	✅	❌
Malicious Container	Deploys a Docker container designed to host escape.	✅	✅
Malicious Package	Installs a DPKG/RPM package to achieve persistence.	✅	❌
NetworkManager	Installs a dispatcher script to persist upon network actions.	✅	❌
LD_PRELOAD Backdoor	Uses LD_PRELOAD to inject malicious libraries for persistence.	✅	❌
LKM Backdoor	Loads a Loadable Kernel Module to maintain persistence.	✅	❌
MOTD Backdoor	Alters Message of the Day (MOTD) to establish persistence.	✅	❌
Package Manager	Manipulates APT/YUM/DNF to establish persistence on usage.	✅	❌
PAM Persistence	Installs a PAM backdoor using a rogue module or pam_exec.	✅	❌
Password Change	Changes user passwords to secure backdoor accounts.	✅	❌
Polkit Backdoor	Creates an overly permissive Polkit configuration backdoor.	✅	❌
Reverse Shell	Establishes a reverse shell (supporting multiple LOLBins).	✅	✅
Shell Profile Persistence	Modifies shell profiles to execute scripts upon user login.	✅	✅
SSH Key Persistence	Manipulates SSH keys to maintain persistent access via SSH.	✅	✅
Sudoers Backdoor	Alters the /etc/sudoers file to grant elevated privileges.	✅	❌
SUID Backdoor	Backdoors binaries by setting the SUID bit.	✅	❌
System Binary Backdoor	Wraps system binaries to include backdoor functionality.	✅	❌
Systemd Service	Creates systemd services that ensure persistence on reboot.	✅	✅
Udev Persistence	Utilizes drivers to persist at the hardware interaction level.	✅	❌
Web Shell Persistence	Deploys web servers for remote access via web interfaces.	✅	✅
XDG Autostart	Employs XDG autostart directories to persist upon user login.	✅	✅

Support

PANIX offers comprehensive support across various Linux distributions.

Distribution	Support	Tested Version
Debian	✅	Debian 11 & 12
Ubuntu	✅	Ubuntu 22.04 (Diamorphine unavailable)
RHEL	✅	RHEL 9 (MOTD & Pre-OS Boot techniques unavailable)
CentOS	✅	CentOS Stream 9 & 7 (MOTD & Pre-OS Boot techniques unavailable)
Fedora	✅	Not fully tested
Arch Linux	✅	Not fully tested
OpenSUSE	✅	Not fully tested