T06 · System Persistence
Error
- Location
- SKILL.md:352
- Finding
- Root-Level Persistent Execution Through a System-Wide Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 352–376 **Vulnerability Type**: Root-level service persistence **Risk Level**: Critical ### Vulnerable Code ```bash ssh root@your-vps.com git clone https://github.com/zxcnny930/avbuzz.git /root/avbuzz cd /root/avbuzz && npm install cp config.example.json config.json && nano config.json ``` ```ini [Unit] Description=AVBUZZ Discord Bot After=network.target [Service] Type=simple WorkingDirectory=/root/avbuzz ExecStart=/usr/bin/node src/index.js Restart=always RestartSec=10 [Install] WantedBy=multi-user.target ``` ```bash systemctl daemon-reload && systemctl enable avbuzz && systemctl start avbuzz journalctl -u avbuzz -f # View logs ``` ### Technical Analysis The deployment instructions direct the user to connect as `root`, install the application under `/root`, and register it as a system-wide systemd service. No `User=` or `Group=` directive is present, so the service inherits root privileges. The combination of `WantedBy=multi-user.target`, `systemctl enable`, and `Restart=always` causes the downloaded Node.js application to start after reboot and restart indefinitely after failures. This creates cross-session persistence for code obtained from an external repository. Persistent execution is relevant to the optional notification feature, but root privileges are not necessary for querying FANZA, sending Discord or Telegram messages, or running scheduled notification logic. The deployment therefore exceeds the minimum privileges required by both the primary on-demand functionality and the optional bot functionality. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or one of the installed npm dependencies. 2. A user follows the documented instructions while logged in as root. 3. `git clone` retrieves attacker-controlled application code into `/root/avbuzz`. 4. `npm install` may execute dependency lifecycle scripts with root privi ...[truncated 830 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a dedicated system account with no interactive shell: ```bash sudo useradd --system --home /opt/avbuzz --shell /usr/sbin/nologin avbuzz ``` 2. Install the application under `/opt/avbuzz` or another restricted application directory rather than `/root`. 3. Set ownership exclusively to the service account and prevent unauthorized modification. 4. Add `User=avbuzz` and `Group=avbuzz` to the service definition. 5. Apply systemd hardening controls such as: ```ini NoNewPrivileges=true PrivateTmp=true ProtectSystem=strict ProtectHome=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true RestrictSUIDSGID=true CapabilityBoundingSet= AmbientCapabilities= ``` 6. Grant write access only to narrowly scoped state directories through `StateDirectory=` or `ReadWritePaths=`. 7. Require explicit user confirmation before enabling boot persistence. Running the bot interactively should be the default deployment mode. 8. Include complete removal instructions covering service disablement, service-file deletion, daemon reload, application deletion, and credential revocation. 9. Do not execute `npm install` or application processes as root. ]]>