# 权限维持
English: Persistence
- Entry Count: 12
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## 注册表持久化
- ID: persistence-registry
- Difficulty: intermediate
- Subcategory: 注册表
- Tags: persistence, registry, windows, autorun
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-registry.md
Description:
通过注册表实现权限维持
Prerequisites:
- 已获得目标机器权限
- 管理员权限
- Windows系统
Execution Outline:
1. Run键持久化
2. RunOnce键
3. Winlogon Helper
4. 服务持久化
Analysis:
注册表持久化会在系统启动或用户登录时执行恶意程序。
OPSEC:
- Run键是最常见的持久化方式，容易被检测
- 考虑使用更隐蔽的方式
- 定期检查注册表异常项
## WMI持久化
- ID: persistence-wmi
- Difficulty: advanced
- Subcategory: WMI
- Tags: wmi, persistence, windows
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-wmi.md
Description:
通过WMI事件订阅实现持久化
Prerequisites:
- 管理员权限
Execution Outline:
1. 创建事件过滤器
2. 创建事件消费者
3. 绑定过滤器和消费者
## 启动文件夹持久化
- ID: persistence-startup
- Difficulty: beginner
- Subcategory: 启动文件夹
- Tags: startup, persistence, windows
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-startup.md
Description:
通过启动文件夹实现持久化
Prerequisites:
- 写入权限
Execution Outline:
1. 当前用户启动文件夹
2. 所有用户启动文件夹
## 服务持久化
- ID: persistence-service
- Difficulty: intermediate
- Subcategory: 服务
- Tags: service, persistence, windows
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-service.md
Description:
通过创建服务实现持久化
Prerequisites:
- 管理员权限
Execution Outline:
1. 创建服务
2. 启动服务
## DLL注入持久化
- ID: persistence-dll-injection
- Difficulty: advanced
- Subcategory: DLL注入
- Tags: dll, injection, persistence
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-dll-injection.md
Description:
通过DLL注入实现持久化
Prerequisites:
- 代码执行权限
- 目标进程
Execution Outline:
1. 创建恶意DLL
2. 注入DLL
3. AppInit_DLLs
## 后门用户
- ID: persistence-backdoor-user
- Difficulty: beginner
- Subcategory: 用户
- Tags: user, backdoor, persistence
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-backdoor-user.md
Description:
创建后门用户账户
Prerequisites:
- 管理员权限
Execution Outline:
1. 创建用户
2. 隐藏用户
3. 修改注册表隐藏
## 隐藏用户
- ID: persistence-hidden-user
- Difficulty: intermediate
- Subcategory: 隐藏用户
- Tags: hidden, user, persistence
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-hidden-user.md
Description:
创建隐藏的管理员用户
Prerequisites:
- SYSTEM权限
Execution Outline:
1. 创建用户
2. 添加到管理员组
3. 注册表隐藏
## 计划任务持久化
- ID: persistence-scheduled
- Difficulty: beginner
- Subcategory: 计划任务
- Tags: persistence, scheduled, task
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-scheduled.md
Description:
通过计划任务实现持久化
Prerequisites:
- 创建任务权限
Execution Outline:
1. 创建登录任务
2. 创建定时任务
3. PowerShell创建
4. Linux Cron
## Skeleton Key后门
- ID: skeleton-key
- Difficulty: advanced
- Subcategory: 域后门
- Tags: skeleton-key, backdoor, domain
- Original Extracted Source: original extracted intranet-security-wiki source/skeleton-key.md
Description:
在域控制器植入万能密码
Prerequisites:
- 域管理员权限
- 访问域控制器
Execution Outline:
1. 植入Skeleton Key
2. 使用万能密码
3. 检测方法
## DSRM后门
- ID: dsrm-backdoor
- Difficulty: expert
- Subcategory: 域后门
- Tags: dsrm, backdoor, domain
- Original Extracted Source: original extracted intranet-security-wiki source/dsrm-backdoor.md
Description:
利用DSRM账户建立后门
Prerequisites:
- 域管理员权限
- 访问域控制器
Execution Outline:
1. 获取DSRM密码
2. 同步DSRM密码
3. 启用DSRM账户
4. 使用DSRM登录
## SID History后门
- ID: sid-history
- Difficulty: advanced
- Subcategory: 域后门
- Tags: sid-history, backdoor, domain
- Original Extracted Source: original extracted intranet-security-wiki source/sid-history.md
Description:
利用SID History建立后门
Prerequisites:
- 域管理员权限
Execution Outline:
1. 添加SID History
2. 验证SID History
3. 使用后门
## 进程镂空持久化
- ID: persistence-process-hollowing
- Difficulty: expert
- Subcategory: 进程注入
- Tags: process-hollowing, persistence, injection
- Original Extracted Source: original extracted intranet-security-wiki source/persistence-process-hollowing.md
Description:
利用进程镂空技术实现持久化
Prerequisites:
- 代码执行权限
Execution Outline:
1. 进程镂空原理
2. C#实现
3. 检测方法

