What is S-PUP?
S-PUP is an advanced open‑source Python tool designed to provide silent, intelligent, and undetected persistence for Python scripts on Linux systems. Its core mechanism relies on automatically replicating the script across multiple sensitive directories and generating systemd services for each copy, ensuring that only a single instance runs at any moment while the remaining instances stay in standby mode, ready to activate when required. The tool enhances persistence by distributing script copies across directories to reduce the risk of deletion or detection, while systemd ensures automatic startup with every system boot and maintains a failover mechanism in which a standby instance immediately replaces the active one if it is removed or disabled. S-PUP copies the script to directories such as ~/.config/.cache/, ~/.local/share/, and ~/Downloads/, and dynamically generates systemd service files with names derived from the original script to increase stealth. Each instance includes a persist_script() function responsible for locating the running script, creating additional copies, generating the required services, and ensuring that no conflicting instances operate simultaneously. The instances also monitor each other indirectly through an active–standby logic that further conceals their behavior. A typical S-PUP project includes main.py, which generates the target script based on user-defined inputs such as email, password, and recipient; S-PUP.py, which implements the persistence logic; and config.py, which stores the configuration. The tool can be used in ethical penetration testing, Red Team operations, self‑experimentation to understand persistence techniques, and research related to resistance against removal. As a practical example, creating a script named spyX.py results in multiple hidden copies placed in ~/.config/.cache/.spyX/, ~/.local/share/.spyX/, and ~/Downloads/.spyX/, each of which is linked to a systemd service such as spyX-cache.service, spyX-share.service, or spyX-dload.service. Only one instance operates actively while the others remain dormant, and if the active instance is deleted, one of the backups is automatically launched. The tool requires Python 3, user‑level permissions to generate systemd services inside $HOME/.config/systemd/user/, and a Linux environment with systemd support. This tool is intended exclusively for ethical hacking, educational use, and legally authorized penetration testing, and the developer, Anas Labrini, bears no responsibility for any misuse. The project is currently under maintenance and stored in a private repository, and is not publicly available at this time.
Back $_ warehouse $_