📖 What is Persistence?
Persistence refers to the techniques used by an attacker to maintain access to a compromised system across restarts or credential changes. Common methods include creating new user accounts, installing backdoors, or modifying registry keys to execute malicious code on boot.
"Persistence is the transition from a temporary exploit to a long-term presence. Look for scheduled tasks or new services as indicators of this phase."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Persistence?
- ▸ Registry Run Keys: Modifying Windows registry keys like HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure malicious binaries execute automatically upon user login.
- ▸ Scheduled Tasks and Cron Jobs: Utilizing tools like schtasks in Windows or crontab in Linux to trigger payload execution at specific time intervals or system events.
- ▸ Account Manipulation: Creating new administrative users or adding existing low-privileged accounts to privileged groups to maintain a reliable entry point into the system.
- ▸ Web Shells: Deploying scripts on a compromised web server to provide a persistent remote command interface accessible via standard HTTP/HTTPS requests.
- ▸ Service Installation: Creating new system services or hijacking existing ones to run backdoors with high-level system privileges that start automatically during boot.
🎯 How does Persistence appear on the PT0-002 Exam?
A scenario might describe a post-exploitation phase where you must ensure access survives a system reboot; you will be asked to select the most effective method, such as modifying a registry run key or creating a scheduled task.
You may be asked to analyze a list of system artifacts to identify an indicator of persistence, such as an unrecognized service running with SYSTEM privileges or an unusual entry in the authorized_keys file.
Expect questions about maintaining access on a Linux server where you must choose between adding an SSH key to the authorized_keys file or modifying the .bashrc file for execution upon login.
❓ Frequently Asked Questions
What is the difference between persistence and privilege escalation?
Privilege escalation is the process of gaining higher-level permissions (e.g., moving from a standard user to Root/SYSTEM), while persistence is the process of ensuring that access is maintained across restarts or credential changes.
Why would an attacker use a web shell for persistence instead of a reverse shell?
A reverse shell requires a continuous active connection that can be easily terminated; a web shell resides on the server, allowing the attacker to re-establish a session at will via a web browser.