______                  __       __   _______             __       __
|   __ .-----.----.-----|__.-----|  |_|   _   .-----.-----|__.-----|  |_
|    __|  -__|   _|__ --|  |__ --|   _|       |__ --|__ --|  |__ --|   _|
|___|  |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
   Author: @Grimmie (@FortyNorthSec)
      Ver: v0.2

Usage: PersistAssist.exe -t [technique] -<extra options>
Provide the persist technique and what to do with the technique (persist, cleanup, display info)
To list all available persistence techiques, use PersistAssist.exe -l
  -t, --technique=VALUE      Persistence technique to use
  -a, --action=VALUE         Action to perform
  -s, --search=VALUE         Keyword to search for
      --cmd, --command=VALUE Command to use as payload
      --rk, --rootkey=VALUE  Root key for registry operations
      --sk, --subkey=VALUE   Sub key for registry operations
      --kv, --keyvalue=VALUE Value to assign regirsty key
      --rc, --registrycontext=VALUE
                             Context to write reg key to (options: hkcu or hklm)
      --tn, --taskname=VALUE Task name to set for MSBuild operations
      --pl, --payload=VALUE  Payload to substitute into template
      --fp, --filepath=VALUE Path to file/directory to target
      --dp, --duplicatepath=VALUE
                             Path to duplicate file times from, modified all
                               timestamps
      --ts, --timestamp=VALUE
                             Specify M(odified), A(ccessed), or C(reated)
                               timestamp. Use ALL to target all timestamps
      --nt, --newtime=VALUE  Specify a new date to change specified timestamp to
      --un, --username=VALUE Specify username for credCheck
      --pw, --passwd=VALUE   Specify password for credCheck
      --efq, --eventFilterQuery=VALUE
                             EventFilter query for WMI event subscription
      --efn, --eventFilterName=VALUE
                             EventFilter name for WMI event subscription
      --ecn, --eventConsumerName=VALUE
                             EventConsumer name for WMI event subscription
      --efv, --eventConsumerValue=VALUE
                             EventConsumer value for WMI event subscription
  -q, --query=VALUE          Query to run
      --dn, --domain=VALUE   Specify current domain
  -p, --persist              Execute specified techique
  -c, --cleanup              Clean up specified technique
  -l, --list                 List available techniques
      --lm, --listmodule=VALUE
                             List available techniques from specified module
                               category
  -i, --info                 Displays information on a specified technique
  -h, --help                 show this message and exit

 ______                  __       __   _______             __       __
|   __ .-----.----.-----|__.-----|  |_|   _   .-----.-----|__.-----|  |_
|    __|  -__|   _|__ --|  |__ --|   _|       |__ --|__ --|  |__ --|   _|
|___|  |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
   Author: @Grimmie (@FortyNorthSec)
      Ver: v0.2

[*] Available modules:

Persistence:
============
Registry:
        GenericRegAdd - Add any arbitrary registry key
        RunKeys - Registers a RunKey on either HKLM or HKCU
MSBuild:
        InlineTasks - Deploys MSBuild InlineTask based payload. Drops file to disk
        OverrideTask - Deploys MSBuild OverrideTask based persistence. Drops file to disk and requires admin access
AccountOperations:
WMI:
Misc:
        PSProfile - Backdoors PowerShell profile files
        StartupFolder - Drops a shortcut to a startup path

Tradecraft:
===========
        SvcList - Lists services on a machine
        Creds - Cred operations
        FileRead - Reads a file in memory to get around having to download files for reading
        NetList - basically ipconfig
        ProcList - Lists running processes
        RegList - Lists contents of specified registry key
        SchList - Lists scheduled tasks on a machine
        TimeStomp - Modifies file and directory time stamps. Does not modify Entry timestamp
        WMIQuery - Run an arbitrary WMI Query
        Compile - Standalone utility to compile exes based on C# payloads included in the framework

Payloads:
=========
CSharp:
        HelloWorld - hola mundo
        MsgBox - Displays a MessageBox
        PopCalc - pops calc
        PopCalcAPI - Pops calc via the API
VBA:

 ______                  __       __   _______             __       __
|   __ .-----.----.-----|__.-----|  |_|   _   .-----.-----|__.-----|  |_
|    __|  -__|   _|__ --|  |__ --|   _|       |__ --|__ --|  |__ --|   _|
|___|  |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
   Author: @Grimmie (@FortyNorthSec)
      Ver: v0.2

Tradecraft:
==========
        SvcList - Lists services on a machine
        Creds - Cred operations
        FileRead - Reads a file in memory to get around having to download files for reading
        NetList - basically ipconfig
        ProcList - Lists running processes
        RegList - Lists contents of specified registry key
        SchList - Lists scheduled tasks on a machine
        TimeStomp - Modifies file and directory time stamps. Does not modify Entry timestamp
        WMIQuery - Run an arbitrary WMI Query
        Compile - Standalone utility to compile exes based on C# payloads included in the framework

Name:     OverrideTask
Desc:     Deploys MSBuild OverrideTask based persistence. Drops file to disk and requires admin access
Usage:
        Persist: PersistAssist.exe -t OverrideTask -p -tn [task name] -pl [payload]
        Cleanup: PeristAssist.exe -t OverrideTask -c -tn [task name]
Category: MSBuild
Author: