In this lesson,
we will cover automating persistence,
a key method in post-exploitation that allows you
to maintain access to a compromised system over time.
We'll focus on three main strategies:
scheduled tasks and cron jobs, service creation,
and modifying registry keys.
Let's start with scheduled tasks and cron jobs.
Scheduled tasks in Windows
and cron jobs in Unix-based systems
are mechanisms that allow you to automate tasks
to run at specific times or intervals.
When you create a scheduled task or cron job,
you can ensure that your payload
or backdoor runs automatically,
maintaining your access even after a system reboot.
In Windows, you can use the schtasks command
to create a scheduled task.
For example, to run a payload every hour,
you might use a command like the following:
Now, let's break this command down.
The scheduled task portion is a command utility
for managing scheduled tasks in Windows.
Next, we have the /create,
this option tells scheduled tasks
to create a new scheduled task.
Then we have the /sc hourly,
this option sets the schedule type to hourly,
meaning the task will run every hour.
Then we have the /tn with "UpdateCheck" in quotes.
This option just names the task,
which will be "UpdateCheck" in this case.
And lastly, we have the /tr
in specifying the payload to execute.
This option just specifies the task to run.
Here, it's going to run the executable located
at "C:\payload.exe".
In Unix-based systems, you can use crontab command
to schedule a cron job.
For instance, to run a payload every hour,
you might add the following line to the cron tab file.
The command breakdown is as follows:
0, this just specifies the minute
of the hour when the task will run.
0 means the task will run at the start of the hour.
And then we have four asterisks.
Each asterisk (*) is a wild card
that represents every possible value
for the corresponding time unit
(minute, hour, day of the month, month, and day of the week)
So together,
0 * * * *
means every hour at the top of the hour, or the zero minute.
And lastly, we have the path to the payload.
This specifies the script or command to be executed.
Here, it points to the shell script located
at /etc/payload.sh.
These methods ensure
that your payload is executed regularly,
maintaining your foothold on the system.
Next, let's discuss service creation.
Creating a new service
on a system can provide a more stealthy
and persistent method for maintaining access.
Services run with system privileges
and can be configured to start automatically
when the system boots,
making them an effective persistence mechanism.
In Windows, you can use the sc command
to create a new service.
For example, let's take a look at this command.
This command creates a service named "MaliciousService"
that runs your payload
and starts automatically on system boot.
For Unix-based systems,
you can create a new service by adding the script
to the /etc/init.d/ directory
and configure it to start at boot
using the update-rc.d command.
Creating services not only ensures persistence
but can also help you operate under the radar,
as services often run in the background
without drawing attention.
Finally, let's cover modifying registry keys.
In Windows, the registry is a hierarchical database
that stores low-level settings
for the operating system and applications.
Modifying specific registry keys can ensure
that your payload runs automatically on startup,
providing a reliable method for maintaining access.
To add a payload to the start process,
you can modify the Run key in the registry.
For example, you can use the reg command as such.
Here in this command,
the reg add command adds an entry to the run key,
ensuring that your payload
is executed every time the user logs in.
You can also modify other registry keys, such as HKLM
for system-wide persistence,
but keep in mind
that this requires administrative privileges.
To bring it all together,
imagine you're conducting a penetration test
on a corporate network.
After gaining initial access to the Windows machine,
you decide to use all three methods to ensure persistence.
First, you create a scheduled task
using the scheduled task command
to run your payload every hour.
Next, you set up a new service
that starts your payload at boot with the sc command.
And lastly, you add an entry to the run register key
with the reg add command
to execute your payload on user login.
These combined methods ensure that you maintain access
to the system regardless of user actions or system reboots.
So, remember, automating persistence
through scheduled tasks or cron jobs, service creation,
and modifying register keys
is essential for maintaining access
to compromised systems in penetration testing.
By leveraging these techniques,
you can ensure that your foothold remains active,
allowing you to continue your testing activities
and achieve your objectives.
Properly implementing and combining these methods
enhance your ability to stay undetected
and maintain control over the target environment.