Intruder has got administrator privileges host, you list several ways to stay back door: (windows and LINUX systems available)

Webshell backdoor 
XSS rear door 
remote control back door & rootit (Windows & LINUX) 
the SSH backdoor 
SHIFT terminal server backdoor 
system user ID clone 
SQL database extended storage type back door 
SQL database sandbox mode backdoor 
Oralce / MySQL custom function 
Oralce privileged user 
MYSQL database backdoor 
file bundled backdoor 
download to your local system user password crack HASH 
gold and silver key 
IIS / Tomcat / WEBLOGIC / APACHE applied backdoor 
keylogger 
....