Monitor Persistence

Hey Folks, In this tutorial we are going to point out another important topic in which we will maintain consistency on the target system by injecting a malicious DLL file on the “monitor” registry. If you want to know about how we can create persistence on window 10 machine through it by hijacking the “oci.dll” file then you can go here.

Lets do it 🙂 !!

Methodology

Spooler.exe is a service responsible for managing spooled print / fax jobs and we will replace the DLL file of this service in the registry with our malicious DLL file after that as soon as the service will start then we will get the meterpreter session again.

Window Access

First we will create a payload to compromise the victim machine using the “msfvenom” tool.

After create the payload we can share it through apache or python share service. Now we will start the multi handler and manage the session by using the following command.

We need to be more privileged to modify the file system or change the permission in the target system and for this purposes we will use the following exploit that will automatically give us all the privileges of the target system.

Persistence – Perform

Now we will create another malicious file using “msfvenom” tool, but this file will be made in DLL file format.
Note : You can change the file name as per need.

Now we have to go to “NT AUTHORITY” meterpreter shell and upload the DLL file on the “system32” directory. After doing all this we will going in the shell and execute the “reg” command that will create a registry key that will contain the value admin.dll. In the next reboot the spoolsv.exe process and registry will locate the malicious DLL file which is stored on the “/windows/system32/” directory.

Wonderful 🙂 !! As soon as the DLL file has load we again get the meterpretter session that means we have successfully created a service, which will give us complete control of the persistent target system.

Source : We would like to appreciate and thank the pentestlab blog for sharing this amazing technique.

Shubham Goyal

A keen learner and passionate IT student. He has done Web designing, CCNA, RedHat, Ethical hacking, Network & web penetration testing. Currently, he is completing his graduation and learning about Red teaming, CTF challenges & Blue teaming.