Signal9Signal9 — home
online
back to labs

Persistence: Clean the Shell RC Backdoor

MediumPersistence Hunting15 min
The brief

Root's shell startup runs an extra command on every interactive login: someone appended a backdoor to /root/.bashrc that phones out to a remote host when the shell starts. Surgically remove ONLY the malicious line — the legitimate content (aliases, PATH, prompt) must stay exactly as it was.

grep -n . /root/.bashrc

Grading checks the backdoor line is gone and the legit lines remain.

What you'll do
  • Remove the backdoor line from /root/.bashrc
  • Preserve all the legitimate .bashrc content

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.