Framework di persistenza completamente modulare
PersistAssist è un framework di persistenza completamente modulare scritto in C#. Tutte le tecniche di persistenza contengono un metodo di pulizia che servirà a rimuovere la persistenza oltre al codice di persistenza stesso. Questo è un work in progress, quindi ci sono molte classi vuote; l'obiettivo principale iniziale di questo progetto era quello di costruire un framework completamente modulare progettato per rendere l'aggiunta di nuove funzionalità semplice come ereditare una classe e aggiungere il codice.
Autore - Victor Suarez (@Gr1mmie)
PersistAssist non avrà binari precompilati, quindi dovrai compilare il codice manualmente. Per farlo, apri il file della soluzione, seleziona "Release" e l'architettura desiderata nel menu di compilazione, quindi premi Avvia.
Per visualizzare il menu di aiuto, usa PersistAssist.exe -h
______ __ __ _______ __ __
| __ .-----.----.-----|__.-----| |_| _ .-----.-----|__.-----| |_
| __| -__| _|__ --| |__ --| _| |__ --|__ --| |__ --| _|
|___| |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
Author: @Grimmie (@FortyNorthSec)
Ver: v0.2
Usage: PersistAssist.exe -t [technique] -<extra options>
Provide the persist technique and what to do with the technique (persist, cleanup, display info)
To list all available persistence techiques, use PersistAssist.exe -l
-t, --technique=VALUE Persistence technique to use
-a, --action=VALUE Action to perform
-s, --search=VALUE Keyword to search for
--cmd, --command=VALUE Command to use as payload
--rk, --rootkey=VALUE Root key for registry operations
--sk, --subkey=VALUE Sub key for registry operations
--kv, --keyvalue=VALUE Value to assign regirsty key
--rc, --registrycontext=VALUE
Context to write reg key to (options: hkcu or hklm)
--tn, --taskname=VALUE Task name to set for MSBuild operations
--pl, --payload=VALUE Payload to substitute into template
--fp, --filepath=VALUE Path to file/directory to target
--dp, --duplicatepath=VALUE
Path to duplicate file times from, modified all
timestamps
--ts, --timestamp=VALUE
Specify M(odified), A(ccessed), or C(reated)
timestamp. Use ALL to target all timestamps
--nt, --newtime=VALUE Specify a new date to change specified timestamp to
--un, --username=VALUE Specify username for credCheck
--pw, --passwd=VALUE Specify password for credCheck
--efq, --eventFilterQuery=VALUE
EventFilter query for WMI event subscription
--efn, --eventFilterName=VALUE
EventFilter name for WMI event subscription
--ecn, --eventConsumerName=VALUE
EventConsumer name for WMI event subscription
--efv, --eventConsumerValue=VALUE
EventConsumer value for WMI event subscription
-q, --query=VALUE Query to run
--dn, --domain=VALUE Specify current domain
-p, --persist Execute specified techique
-c, --cleanup Clean up specified technique
-l, --list List available techniques
--lm, --listmodule=VALUE
List available techniques from specified module
category
-i, --info Displays information on a specified technique
-h, --help show this message and exit
Per elencare i moduli disponibili, usa PersistAssist.exe -l
______ __ __ _______ __ __
| __ .-----.----.-----|__.-----| |_| _ .-----.-----|__.-----| |_
| __| -__| _|__ --| |__ --| _| |__ --|__ --| |__ --| _|
|___| |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
Author: @Grimmie (@FortyNorthSec)
Ver: v0.2
[*] Available modules:
Persistence:
============
Registry:
GenericRegAdd - Add any arbitrary registry key
RunKeys - Registers a RunKey on either HKLM or HKCU
MSBuild:
InlineTasks - Deploys MSBuild InlineTask based payload. Drops file to disk
OverrideTask - Deploys MSBuild OverrideTask based persistence. Drops file to disk and requires admin access
AccountOperations:
WMI:
Misc:
PSProfile - Backdoors PowerShell profile files
StartupFolder - Drops a shortcut to a startup path
Tradecraft:
===========
SvcList - Lists services on a machine
Creds - Cred operations
FileRead - Reads a file in memory to get around having to download files for reading
NetList - basically ipconfig
ProcList - Lists running processes
RegList - Lists contents of specified registry key
SchList - Lists scheduled tasks on a machine
TimeStomp - Modifies file and directory time stamps. Does not modify Entry timestamp
WMIQuery - Run an arbitrary WMI Query
Compile - Standalone utility to compile exes based on C# payloads included in the framework
Payloads:
=========
CSharp:
HelloWorld - hola mundo
MsgBox - Displays a MessageBox
PopCalc - pops calc
PopCalcAPI - Pops calc via the API
VBA:
Per elencare solo i moduli appartenenti a una categoria specifica, usa -lm. Ad esempio, per elencare tutti i moduli Tradecraft disponibili: PersistAssist.exe -lm Tradecraft
______ __ __ _______ __ __
| __ .-----.----.-----|__.-----| |_| _ .-----.-----|__.-----| |_
| __| -__| _|__ --| |__ --| _| |__ --|__ --| |__ --| _|
|___| |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
Author: @Grimmie (@FortyNorthSec)
Ver: v0.2
Tradecraft:
==========
SvcList - Lists services on a machine
Creds - Cred operations
FileRead - Reads a file in memory to get around having to download files for reading
NetList - basically ipconfig
ProcList - Lists running processes
RegList - Lists contents of specified registry key
SchList - Lists scheduled tasks on a machine
TimeStomp - Modifies file and directory time stamps. Does not modify Entry timestamp
WMIQuery - Run an arbitrary WMI Query
Compile - Standalone utility to compile exes based on C# payloads included in the framework
La sezione Persistence contiene le tecniche disponibili che possono essere utilizzate, i moduli Tradecraft fungono da funzioni di utilità per eseguire varie operazioni, e i moduli Payload contengono payload che possono essere usati per vari compiti di persistenza, anche se attualmente sono disponibili solo per il modulo OverrideTask.
Per ottenere informazioni su un modulo, usa PersistAssist.exe -t [technique] -i
Name: OverrideTask
Desc: Deploys MSBuild OverrideTask based persistence. Drops file to disk and requires admin access
Usage:
Persist: PersistAssist.exe -t OverrideTask -p -tn [task name] -pl [payload]
Cleanup: PeristAssist.exe -t OverrideTask -c -tn [task name]
Category: MSBuild
Author: