If you're testing the copy.fail/exp Python exploit (or similar modern Linux page cache poisoning exploits) and find that echo 3 > /proc/sys/vm/drop_caches does not remove the backdoor, here is the technical breakdown of what actually happened to your system and how to fix it.
TL;DR: The exploit bypasses the dirty flag, but the page can be flushed to disk if a kernel sync or background process touches that memory segment.Β Β If you wait too long to drop the caches like I did, the Linux kernel's background threads will permanently write the backdoor to your physical disk.Β Β I had to force-reinstall the package and clear my bash hash cache to fully cleanup this exploit.
Here is a deep dive into my findings (with Gemini's help):
The Python payload doesn't just drop a new binary; it performs a surgical strike on the existing utility (like /usr/bin/su).Β Β It uses the splice() system call to link the file's memory pages to a pipe, and then abuses a kernel flaw i
