sliver Persistence Module

Automatic per-platform (Windows/MacOS/Linux) persistence commands.

Feb 01 '19 00:02 moloch--

Persistence is inherently not op-sec safe due to the requirements of storing information on disk. However I think we should decide on the best methods of persisting on the 3 major OS's. (Linux, MacOS, and Windows)

Possible Options:

Linux /tmp/... Cron is the most common way to persist on Linux. printf "*/5 * * * * /tmp/..." | crontab
MacOS
- User: launchctl
- Root: emond or sudo /bin/bash -c 'echo "touch /tmp/pwned" > /etc/periodic/daily/000.pwned && chmod +x /etc/periodic/daily/000.pwned'

Windows

User: Registry Keys or Scheduled Tasks

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

schtasks /create /rp "" /tn "" /tr C:\Windows\System32\mshta.exe js-DotNet-Go /sc onlogon

Root: Registry Keys or at.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

C:\Windows\System32\at.exe at 08:00 /every:m,t,w,th,f,s,su C:\Windows\System32\mshta.exe js-DotNet-Go