Skip to content

Registry

Jump to bottom
h4wkst3r edited this page Aug 25, 2019 · 2 revisions

Description

This persistence technique will create a registry key and value of your choosing. For supported registry keys in this module, see the "TABLE OF SUPPORTED REGISTRY KEYS" section. In this module, you will supply a registry key, value and system command to execute.

Privileges Required

Non-admin privileges

Arguments/Options Required

  • -c - command to execute
  • -a - arguments to command to execute (if applicable)
  • -k - registry key to modify
  • -v - registry value to create/delete
  • -m - method (add, remove, check, list)
  • -o - optional add-on for env variable obfuscation (env) if applicable

Registry Keys

  • hklmrun - HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  • hklmrunonce - HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • hklmrunonceex - HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
  • hkcurun - HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • hkcurunonce - HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

Pre-Defined Registry Key Values

The below registry keys have pre-defined values. Therefore, a value does not need specified for these. Also, the "env" optional add-on is not supported with pre-defined registry key values.

  • logonscript - HKCU\Environment\UserInitMprLogonScript
  • stickynotes - HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RESTART_STICKY_NOTES
  • userinit - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Table of Supported Registry Keys

Registry Key Code (-k) Registry Key Registry Value Admin Privileges Required? Supports Env Optional Add-On (-o env)?
hkcurun HKCU\Software\Microsoft\Windows\CurrentVersion\Run User supplied No Yes
hkcurunonce HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce User supplied No Yes
logonscript HKCU\Environment UserInitMprLogonScript No No
stickynotes HKCU\Software\Microsoft\Windows\CurrentVersion\Run RESTART_STICKY_NOTES No No
hklmrun HKLM\Software\Microsoft\Windows\CurrentVersion\Run User supplied Yes Yes
hklmrunonce HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce User supplied Yes Yes
hklmrunonceex HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx User supplied Yes Yes
userinit HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit Yes No

Changes Made to Target System/Caveats

Adding Registry Persistence

  • If using the environmental optional add-on (-o env), the command and/or arguments are added in the value entered in an environmental registry key, based on registry hive.
    • For HKCU - HKCU\Environment
    • For HKLM - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
    • The registry key specified will have the value entered added as %value%. The %value% will be looked up in the associated environmental registry key and value, which will contain the actual command and argument you specified to execute.

Removing Registry Persistence

  • If using the environmental optional add-on (-o env), both the registry key value and its associated environmental registry key value will be removed.

Usage/Examples

Adding Registry Persistence Trigger

SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add

Adding Registry Persistence Trigger (w/ env variable optional add-on)

SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add -o env

Adding Registry Persistence Trigger (w/ pre-defined registry value)

SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "logonscript" -m add

Removing Registry Persistence Trigger

SharPersist -t reg -k "hkcurun" -v "Test Stuff" -m remove

Removing Registry Persistence Trigger (w/ env variable optional add-on)

SharPersist -t reg -k "hkcurun" -v "Test Stuff" -m remove -o env

Removing Registry Persistence Trigger (w/ pre-defined registry value)

SharPersist -t reg -k "logonscript" -m remove

Perform Dry Run of Registry Persistence

SharPersist -t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m check

List Registry Values Given in Persistence Location

SharPersist -t reg -k "hkcurun" -m list

References

Clone this wiki locally