Logo
r41n•
( 03 )NOTES/SHELL_STARTUP_PERSISTENCE
SYNC0x4A1F
notes/shell-startup-persistence
linux

Shell Startup Persistence

Quick notes on Linux shell startup files and how they can be abused for persistence.

2026-09-12
1 min read
linuxshellpersistencebashenumerationred-team

Common Startup Files#

Common Bash files: ~/.bashrc ~/.bash_profile ~/.profile Other shells may use files such as: ~/.zshrc
System-wide configuration can include: /etc/profile /etc/profile.d/ /etc/bash.bashrc These can affect multiple users.
shell startup enumeration
>ls -la ~/{.bashrc,.bash_profile,.profile,.zshrc} 2>/dev/null
>grep -nE 'curl|wget|nc|bash|python|sh ' ~/.bashrc ~/.profile 2>/dev/null
>ls -la /etc/profile.d/
>
Findings
INFO
Look for: • Unknown commands • Scripts from unusual locations • Commands connecting to remote hosts • Obfuscated or encoded commands • Recently modified startup files • Startup files writable by unexpected users
file inspection
>stat ~/.bashrc
>ls -l ~/.bashrc
>

Takeaway#

When investigating shell persistence, inspect both user and system-wide startup files and follow suspicious commands to whatever they execute.

Back to Notesnote: shell-startup-persistence