完全模块化的持久化框架
PersistAssist 是一个完全模块化的持久化框架，使用 C# 编写。所有持久化技术都包含一个清理方法，用于在持久化代码之外移除持久化。这是一个正在进行中的项目，因此有许多空类。此项目最初的主要目标是构建一个完全模块化的框架，使得添加新功能只需继承一个类并添加代码即可。
作者 - Victor Suarez（@Gr1mmie）
PersistAssist 不会提供预编译的二进制文件，因此您需要手动编译代码。要完成此操作，请打开解决方案文件，在构建菜单中选择“Release”以及所需架构，然后点击开始。
要查看帮助菜单，请使用 PersistAssist.exe -h
______ __ __ _______ __ __
| __ .-----.----.-----|__.-----| |_| _ .-----.-----|__.-----| |_
| __| -__| _|__ --| |__ --| _| |__ --|__ --| |__ --| _|
|___| |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
Author: @Grimmie (@FortyNorthSec)
Ver: v0.2
Usage: PersistAssist.exe -t [technique] -<extra options>
Provide the persist technique and what to do with the technique (persist, cleanup, display info)
To list all available persistence techiques, use PersistAssist.exe -l
-t, --technique=VALUE Persistence technique to use
-a, --action=VALUE Action to perform
-s, --search=VALUE Keyword to search for
--cmd, --command=VALUE Command to use as payload
--rk, --rootkey=VALUE Root key for registry operations
--sk, --subkey=VALUE Sub key for registry operations
--kv, --keyvalue=VALUE Value to assign regirsty key
--rc, --registrycontext=VALUE
Context to write reg key to (options: hkcu or hklm)
--tn, --taskname=VALUE Task name to set for MSBuild operations
--pl, --payload=VALUE Payload to substitute into template
--fp, --filepath=VALUE Path to file/directory to target
--dp, --duplicatepath=VALUE
Path to duplicate file times from, modified all
timestamps
--ts, --timestamp=VALUE
Specify M(odified), A(ccessed), or C(reated)
timestamp. Use ALL to target all timestamps
--nt, --newtime=VALUE Specify a new date to change specified timestamp to
--un, --username=VALUE Specify username for credCheck
--pw, --passwd=VALUE Specify password for credCheck
--efq, --eventFilterQuery=VALUE
EventFilter query for WMI event subscription
--efn, --eventFilterName=VALUE
EventFilter name for WMI event subscription
--ecn, --eventConsumerName=VALUE
EventConsumer name for WMI event subscription
--efv, --eventConsumerValue=VALUE
EventConsumer value for WMI event subscription
-q, --query=VALUE Query to run
--dn, --domain=VALUE Specify current domain
-p, --persist Execute specified techique
-c, --cleanup Clean up specified technique
-l, --list List available techniques
--lm, --listmodule=VALUE
List available techniques from specified module
category
-i, --info Displays information on a specified technique
-h, --help show this message and exit
要列出可用模块，请使用 PersistAssist.exe -l
______ __ __ _______ __ __
| __ .-----.----.-----|__.-----| |_| _ .-----.-----|__.-----| |_
| __| -__| _|__ --| |__ --| _| |__ --|__ --| |__ --| _|
|___| |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
Author: @Grimmie (@FortyNorthSec)
Ver: v0.2
[*] Available modules:
Persistence:
============
Registry:
GenericRegAdd - Add any arbitrary registry key
RunKeys - Registers a RunKey on either HKLM or HKCU
MSBuild:
InlineTasks - Deploys MSBuild InlineTask based payload. Drops file to disk
OverrideTask - Deploys MSBuild OverrideTask based persistence. Drops file to disk and requires admin access
AccountOperations:
WMI:
Misc:
PSProfile - Backdoors PowerShell profile files
StartupFolder - Drops a shortcut to a startup path
Tradecraft:
===========
SvcList - Lists services on a machine
Creds - Cred operations
FileRead - Reads a file in memory to get around having to download files for reading
NetList - basically ipconfig
ProcList - Lists running processes
RegList - Lists contents of specified registry key
SchList - Lists scheduled tasks on a machine
TimeStomp - Modifies file and directory time stamps. Does not modify Entry timestamp
WMIQuery - Run an arbitrary WMI Query
Compile - Standalone utility to compile exes based on C# payloads included in the framework
Payloads:
=========
CSharp:
HelloWorld - hola mundo
MsgBox - Displays a MessageBox
PopCalc - pops calc
PopCalcAPI - Pops calc via the API
VBA:
要仅列出属于特定类别的模块，请使用 -lm。例如，列出所有可用的 Tradecraft 模块：PersistAssist.exe -lm Tradecraft
______ __ __ _______ __ __
| __ .-----.----.-----|__.-----| |_| _ .-----.-----|__.-----| |_
| __| -__| _|__ --| |__ --| _| |__ --|__ --| |__ --| _|
|___| |_____|__| |_____|__|_____|____|___|___|_____|_____|__|_____|____|
Author: @Grimmie (@FortyNorthSec)
Ver: v0.2
Tradecraft:
==========
SvcList - Lists services on a machine
Creds - Cred operations
FileRead - Reads a file in memory to get around having to download files for reading
NetList - basically ipconfig
ProcList - Lists running processes
RegList - Lists contents of specified registry key
SchList - Lists scheduled tasks on a machine
TimeStomp - Modifies file and directory time stamps. Does not modify Entry timestamp
WMIQuery - Run an arbitrary WMI Query
Compile - Standalone utility to compile exes based on C# payloads included in the framework
持久化部分包含可用的技术，交易技巧模块作为实用函数来执行各种操作，而负载模块包含可用于各种持久化任务的负载，但目前仅适用于 OverrideTask 模块。
要返回某个模块的信息，请使用 PersistAssist.exe -t [technique] -i
Name: OverrideTask
Desc: Deploys MSBuild OverrideTask based persistence. Drops file to disk and requires admin access
Usage:
Persist: PersistAssist.exe -t OverrideTask -p -tn [task name] -pl [payload]
Cleanup: PeristAssist.exe -t OverrideTask -c -tn [task name]
Category: MSBuild
Author: