NetExec icon indicating copy to clipboard operation
NetExec copied to clipboard

[New SMB Module] Persistence Module

Open KriyosArcane opened this issue 5 months ago • 2 comments

Description

This is from https://github.com/Pennyw0rth/NetExec/pull/496. Since kapla lost access to his account, he was not able to update the module in the same account and I got permission from him to create a new PR with updated version. You can check old PR for the details because I don't have patience to take new screenshots :)

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • [ ] Bug fix (non-breaking change which fixes an issue)
  • [x] New feature (non-breaking change which adds functionality)
  • [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [ ] Deprecation of feature or functionality
  • [ ] This change requires a documentation update
  • [ ] This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

Please provide guidance on what setup is needed to test the introduced changes, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions. In particular:

  • Bug Fix: Please provide a short description on how to trigger the bug, to make the bug reproducable for the reviewer.
  • Added Feature/Enhancement: Please specify what setup is needed in order to test the changes. E.g. is additional software needed? GPO changes required? Specific registry settings that need to be changed?

Screenshots (if appropriate):

Screenshots are always nice to have and can give a visual representation of the change. If appropriate include before and after screenshot(s) to show which results are to be expected.

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • [ ] I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
  • [ ] I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • [x] New and existing e2e tests pass locally with my changes
  • [x] If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • [x] I have performed a self-review of my own code
  • [ x I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

KriyosArcane avatar Jul 17 '25 13:07 KriyosArcane

Hey man, just wanted to mention that if you care about ""detection"" you should may be rely on the remote registry to set those keys instead of a "cmd.exe > reg.exe" ^^ That's only if you care about stealth tho :)

Dfte avatar Jul 23 '25 14:07 Dfte

Hey man, just wanted to mention that if you care about ""detection"" you should may be rely on the remote registry to set those keys instead of a "cmd.exe > reg.exe" ^^ That's only if you care about stealth tho :)

Hey! I actually only fulfilled previous issues mentioned but I could edit it to use nxc built in functions

KriyosArcane avatar Jul 23 '25 14:07 KriyosArcane