{"id":157,"date":"2021-11-12T17:08:19","date_gmt":"2021-11-12T17:08:19","guid":{"rendered":"https:\/\/www.davincivirus.com\/?p=157"},"modified":"2021-11-12T17:08:19","modified_gmt":"2021-11-12T17:08:19","slug":"persistence","status":"publish","type":"post","link":"https:\/\/www.davincivirus.com\/?p=157","title":{"rendered":"Persistence"},"content":{"rendered":"\n<p><strong>Service Manipulation<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em>(Can be run remotely)    \n<span style=\"text-decoration: underline;\">**Spaces are important in WIN7.<\/span><\/em>\nsc create &lt;servicename> binpath= \"&lt;c:\\PATH>\" displayname= \"&lt;NAME>\" start= auto\nsc description &lt;servicename> \"&lt;DESCRIPTION>\"\nsc qc &lt;servicename>\nsc start &lt;servicename>\nsc stop &lt;servicename>\nsc delete &lt;servicename>\nsc qfailure (shows value for service failures)<\/code><\/pre>\n\n\n\n<p><strong>Registry<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \/v \"&lt;APP NAME>\" \/t REG_SZ \/f \/d \"c:\\&lt;FILEPATH>\"\nreg query \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \/v \"&lt;APP NAME>\"\nwmic useraccount where (name='guy.fleegman') get name,sid   (returns a user's SID if needed)<\/code><\/pre>\n\n\n\n<p><strong>Startup Folder<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>c:\\users\\&lt;username>\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/code><\/pre>\n\n\n\n<p><strong>SCHTASKS<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em>(IF PRIVILEGED - RU and SC ONLOGON options are available)\r\n<\/em>schtasks.exe \/Create \/F \/SC DAILY \/ST 09:22 \/TN \"&lt;TASKNAME>\" \/TR \"&lt;PAYLOAD_FILEPATH>\"\nschtasks.exe \/Create \/F \/RU SYSTEM \/SC ONLOGON \/TN \"&lt;TASKNAME>\" \/TR \"&lt;PAYLOAD_FILEPATH>\"\nschtasks.exe \/DELETE \/F \/TN \"&lt;TASKNAME>\"<\/code><\/pre>\n\n\n\n<p><strong>DLL Hijacking<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>- The \"ikeext\" service on windows permits persistence on Windows 7; using wlbsctrl.dll.  A wrapper dll (named wlbsctrl.dll) is created with a MUTEX that loads a cobalt strike payload (such as a CS DLL).\n\n- WptsExtensions.dll is affiliated with the \"schedule\" service. It does not exist anymore, and is therefore prone to a dll hijacking attack. The scheduler service starts on reboot.<\/code><\/pre>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Service Manipulation Registry Startup Folder SCHTASKS DLL Hijacking<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts\/157"}],"collection":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=157"}],"version-history":[{"count":1,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts\/157\/revisions"}],"predecessor-version":[{"id":158,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=\/wp\/v2\/posts\/157\/revisions\/158"}],"wp:attachment":[{"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.davincivirus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}