Skip to content

Persistence

Dave Hardy edited this page Jul 6, 2016 · 7 revisions

Persistence

Install-Persistence / Remove-Persistence

The Install-Persistence and Remove-Persistence commands create a 'Userland' persistence through the use of the 'Run' registry keys. These DO NOT require elevated privileges.

Install-Persistence

One point to note with the output in the C2-Sever PowerShell window, you will notice that the whole PowerShell command ran against the victim is displayed, within this you will see any error traps and the associated output. Please ignore this and refer to the output Command returned against host:xxxxx

Install-ServiceLevel-Persistence | Remove-ServiceLevel-Persistence

The Install-ServiceLevel-Persistence is the equivalent SYSTEM level persistence to the above. Elevated privileges ARE required, as can be seen in the screen shot.

Install-ServiceLevel-Persistence

Install-ServiceLevel-PersistenceWithProxy | Remove-ServiceLevel-Persistence

The Install-ServiceLevel-PersistenceWithProxy is fundamentally the same as Install-ServiceLevel-Persistence, however the command requires a payload with proxy credentials, which first needs to be created with the 'Create-ProxyPayload' command, the command will determine whether or not a proxy payload has been created previously and warn the user of the case.

Install-ServiceLevel-PersistenceWithProxy