Kali Linux 2018: Windows Penetration Testing - Second Edition

Windows registry-only persistence

The Windows registry is a great place to hide malicious code. A lot of malware and spyware use methods like this to hide and run their payloads. The complexity of the registry and the system access level of the registry make it a great attack vector.

We will run the following module on the current running session and attempt to get the payload to run with system level access. The module's information is as follows:

    msf exploit(registry_persistence) > info
    
    Name: Windows Registry Only Persistence
    Module: exploit/windows/local/registry_persistence
    Platform: Windows
    Privileged: No
    License: Metasploit Framework License (BSD)
    Rank: Excellent
    Disclosed: 2015-07-01
    
    Provided by:
    Donny Maasland <[e-mail]> ...