PersistBOF is a tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User) Usage Clone, run make, add .cna to Cobalt Strike client. run: help persist-ice in CS console Syntax: persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] …
Continue reading “PersistBOF : Tool To Help Automate Common Persistence Mechanisms”