PersistBOF - A BOF to automate common persistence tasks for red

项目说明

PersistBOF

A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), Junction Folder (User), Xll Add-In (User).

Usage

Clone, run make, add .cna to Cobalt Strike client.

run: help persist-ice in CS console

Syntax:

persist-ice [PrintMon, TimePro, Junction, Xll] [persist or clean] [arg1] [arg2];

Technique O

All of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF.

Xll Add-in

Create Dll with export xlAutoOpen(). Rename .dll to .xll and place in %appdata%\Microsoft\Addins. Will be loaded any time Excel is opened with no notification. Writes a registry key to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\\{ number}\Excel\Options , provide the correct number as there may be multiple.

Example:

persist-ice Xll persist XllName.xll 16

persist-ice Xll clean XllName.xll 16 > Will delete the registry key and attempt to delete the dll.

Print Monitor

The Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will *immediately* be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run.

Demo Print Monitor Dll in project

Example:
1. upload NotMalware.dll to C:\Windows\NotMalware.dll
2. persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll
3. Immediately executes as SYSTEM
4. Will execute on startup until removed
5. persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed.

Time Provider

Loaded by s.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run.

Demo Time Provider Dll in project

Example:

persist-ice TimePro TotesLegitTimeProvider C:\anywhere\NotMalware.dll

persist-ice TimePro TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process.

Junction Folder

Same technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe

NOTE: This needs to be a COM server dll to run properly. You can execute code out of DllRegisterServer, DllMain, or DllGetClassObject depending on what you are trying to do. Make sure to implement other required exports

Example:

persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Sa

persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll.

Start Folder Hijack

Create a new, user writeable folder, copy a hijackable windows binary to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated.

Example:

persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder

persist-ice Shortcut clean C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail.

References

项目信息

开发语言：C

Star 数：297

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A BOF to automate common persistence tasks for red teamers展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。