#red-team

2 posts

Linux Persistence: Abusing Cron for Survival Across Reboots

How an attacker with shell access turns the native Linux task scheduler into a persistent backdoor that survives reboots, runs silently, and blends with legitimate system operations.

Oct 1, 2026—23 min read

◆

Windows Post-Exploitation: Enabling Remote Desktop (RDP)

After compromising a Windows host, an attacker with local administrator access can enable RDP by modifying a single registry value, opening the firewall, and optionally disabling NLA. This turns a command-line shell into full graphical access using built-in Windows functionality.

Sep 30, 2026—10 min read