PT0-001 · Question #1
A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which of the following would achieve that goal?
The correct answer is D. reg save HKLM\System\CurrentControlSet\Services\Sv.reg. Modifying Windows registry service keys under HKLM\System\CurrentControlSet\Services establishes persistence because registered services start automatically at every system boot.
Question
A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which of the following would achieve that goal?
Options
- Aschtasks.exe /create/tr "powershell.exe" Sv.ps1 /run
- Bnet session server | dsquery -user | net use c$
- Cpowershell && set-executionpolicy unrestricted
- Dreg save HKLM\System\CurrentControlSet\Services\Sv.reg
How the community answered
(55 responses)- A13% (7)
- B7% (4)
- C4% (2)
- D76% (42)
Why each option
Modifying Windows registry service keys under HKLM\System\CurrentControlSet\Services establishes persistence because registered services start automatically at every system boot.
The schtasks.exe syntax is malformed - it is missing required parameters such as /tn for the task name and /sc for the schedule type, making the command non-functional.
These commands perform network session enumeration and share mapping for lateral movement, not persistence - they do not create any mechanism that survives a reboot.
Setting the PowerShell execution policy to unrestricted changes script execution behavior for the current session environment but does not create any auto-starting mechanism that persists across reboots.
Adding or modifying a service entry under HKLM\System\CurrentControlSet\Services achieves persistence because Windows automatically starts all registered services at boot, allowing the attacker to maintain access across reboots. The reg save command exports this registry hive, preserving the malicious service configuration (Sv) in a way that survives system restarts.
Concept tested: Windows registry service-based persistence technique
Source: https://attack.mitre.org/techniques/T1543/003/
Topics
Community Discussion
No community discussion yet for this question.