In this lesson,
we're going to cover how to maintain persistence
by tampering with security controls,
focusing on both Windows and Linux environments.
Maintaining persistence means keeping your access
to a system,
even if the initial exploit or vulnerability is fixed.
One way to achieve this
is by disabling or tampering with security controls,
like firewalls, antivirus programs,
and other defensive measures.
First, let's talk about disabling firewalls.
Firewalls are designed to block unauthorized access
to a network or system,
so turning them off can help you maintain your foothold.
On a Windows system,
you can use the command line to disable the firewall.
For example,
running "netsh advfirewall set allprofiles state off"
will turn off the firewall for all profiles.
This command can be executed through a script or directly
if you have a administrative privileges.
On Linux, you can disable the firewall
using commands like "ufw disable"
for systems using Uncomplicated Firewall,
or "systemctl stop firewalld"
for systems using firewalld.
Next, let's look at antivirus software.
Antivirus programs are meant to detect
and remove malicious software,
so disabling them can help avoid detection.
On Windows, you might use PowerShell
to disable Windows Defender.
You can use a command that turns off real-time monitoring,
which is a key feature of the antivirus program.
On Linux, you might find ClamAV
running as an antivirus solution.
You can stop it
by running a command like
"systemctl stop clamav-freshclam."
Tampering with security policies
is another effective method.
Security policies often enforce password rules,
account lockouts, and other security measures.
By modifying these policies,
you can create backdoor accounts with fewer restrictions.
On a Windows machine, you can use the "secedit" command
to export and import security policies,
making it possible to alter them to your advantage.
On Linux, you could modify the PAM
or Pluggable Authentication Modules configurations,
typically found in the /etc/pam.d/ folder,
to weaken security policies.
Registry modifications can also be useful
for maintaining persistence.
The Windows registry contains settings
and configurations for the operating system
and installed applications.
By adding or modifying registry keys,
you can ensure your malicious software
runs every time the system starts.
Let's start with how you can make a program
run automatically when a Windows computer starts up.
By adding your program to a specific place
in the Windows registry -
you can think of that
as the system database for important settings-
you can make sure that it runs every time
the computer boots up.
You would need to modify the following value
in the Windows registry:
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\Current Version\Run."
When you add an entry here,
Windows knows to execute the program during startup.
Next, let's talk about disabling security login.
to cover your tracks.
Security logs keep a record
of everything happening on the system,
which is useful for security administrators
to detect any suspicious activities.
To stop Windows from logging this information,
you can use two commands.
First, "sc stop EventLog"
stops Windows Event Log services from running
which halts the recording of logs.
Then, "sc config EventLog start= disabled"
is used to make sure that the logging services
doesn't start again the next time the computer is rebooted.
Moving on to persistence through scheduled tasks,
you can set up a task on Windows
that automatically runs a specific program
or a script at regular intervals
or whenever the system starts.
For this, the "schtasks" command is used.
Let's say we have a script located right on the C drive
disguised as "update.bat" for example.
We can use the command schtask /create /tn,
which stands for task name, "update" /tr,
which stands for task to run,
and we have the location at the "C:update.bat"/sc onstart,
which creates a scheduled task named "update"
that runs your script every time the system starts.
Now, let's shift over to Linux.
On Linux, making a program run as startup
is similar to Windows.
Instead of using the registry, you can edit startup scripts
or set up tasks that run automatically.
For example, you can add a script to /etc/rc.local,
which is a script that runs every time the system reboots.
Alternatively, you can use cron jobs
by editing the cron file with the "crontab -e" command
and adding a line like "@reboot /etc/maliciousscript.sh."
This tells the system to run your script whenever it starts.
If you want to disable security login on Linux,
you can stop the logging services.
For example, "systemctl stop rsyslog."
This command will stop the rsyslog service,
which is responsible for recording system log
and sending them to a remote server.
Another way to cover your tracks
is by modifying logrotate configurations,
which control how logs are saved and deleted,
so they get removed more frequently.
Lastly, let's consider disabling user account controls,
or UAC.
UAC is a security feature in Windows
that helps prevent unauthorized changes to the system.
By lowering the UAC settings or turning it off,
you can make it easier to run your programs
with administrative privileges.
This can be done through the registry
or local security policy settings.
On Linux, while there isn't a direct equivalent to UAC,
you can weaken security by configuring "sudo"
to allow passwordless execution of commands
for certain users, modifying the /etc/sudoers file.
So remember, to maintain persistence
by tampering with security controls,
you can disable firewalls and antivirus programs,
modify security policies,
change values in the registry or startup scripts,
disable security logging, create scheduled tasks,
and lower or disable user account controls.
These actions help ensure that your access remains
even if initial vulnerabilities are patched,
whether you're working on Windows or Linux systems.