Linux Shell and Profile Persistence

Shell startup files execute automatically when a user opens a session. Adding a payload to these files gives persistent execution tied to user login without creating cron jobs or services. Profile-based persistence is low-noise but only triggers when a user authenticates — it does not run on reboot without a login event.

User shell startup files

These files execute for every interactive shell or login session of the target user. No root required — only write access to the target user's home directory.

Always append with & to background the payload process. Without it, the shell hangs waiting for the payload to exit and the user will notice immediately. Redirect stderr to /dev/null to suppress error messages if the payload is not yet present.

System-wide profile files

These execute for all users and require root to modify. Use when you want persistence across every account rather than a specific user.

LD_PRELOAD persistence

LD_PRELOAD forces a shared library to load before any other library when a program is executed. Adding it to a user's environment causes the library — and any code in its constructor function — to run whenever that user executes a binary.

MOTD and PAM persistence

The message-of-the-day scripts in /etc/update-motd.d/ run as root every time a user logs in via SSH. Adding a script there gives root-level execution on every SSH login without touching cron or systemd.

Cleaning up