Persistence: Remove the Systemd Backdoor

MediumPersistence Hunting15 min

The brief

Incident response: a service was planted in /etc/systemd/system/ for persistence and enabled to start on boot — a rogue unit that doesn't belong, plus its enable symlink in multi-user.target.wants/. Find it and eradicate it COMPLETELY — the unit file AND its enable symlink — while leaving the box's legitimate service untouched.

ls -la /etc/systemd/system/ /etc/systemd/system/multi-user.target.wants/

Grading checks the backdoor unit and its symlink are gone and the real service survives. (No daemon reload needed here — you're removing the on-disk unit.)

What you'll do

Delete the malicious systemd service unit and its enable symlink
Leave the legitimate myapp.service in place

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.