In this lecture, we will gain persistence on the system by using run at start up future of Windows.
To do so, we will create a class called persistence, and inside the class we will define a function
to add our executable file to start up folder by using registry keys.
In order to use registry keys, we will use registry package of .NET that, but it's not a
defaultly the installed package, so you need to install it first.
We will be using two methods.
Opensubkey method for opening the registrky key, and setvalue method for setting a new value into the
key, the full path of the registry key, which is corresponding to the start up folder, is this.
So if you need it, just copy and use it.
Let's start coding, but if you are new to this concepts, I highly encourage you to learn more about
them before keep continue.
So lets continue now.
We need to create a class to do so, create a new file by clicking the new file button.
I would call it pers.cs and copy the contents of the program.cs into the new file you have
created.
Oops, sorry about that, it shouldn't be here and copy the contents.
Changed the last name, I will use persistance as my class name and remove that trivial part.
For the first step, we need to install the registry package to do so, open up your terminal and type
dotnet add package Microsoft.Win32.Registry
For the next step, we need to create a function.
Let's do it.
I will call it, addtostartup
Since it won't be returning anything I selected void as my return data type.
And for the next step, we need to create an instance of registrykey class to do so, use
Microsoft.Win32 namespace and use registrykey
and create an instance of it, I will use a rkInstance as name.
And we will be using opensubkey method of the registry class in order to open a registry key to do so,
use Microsoft.Win32 namespace again, we will be using current user's opensubkey method.
Opensubkey method takes two arguments, the first one is the full path of the registry key and second
one is for.
write access.
Let's copy the full path of the registry key as first argument
and for the second argument we will use true, as you can see from its definition set it to true, if
you need to write access to the key, so we need to write it.
So we set it true.
And we will use the setvalue method of the registry key in order to add or executable file to start-up
folder.
This method takes two arguments, first one is the name, it doesn't matter which name you
are using.
I will be using the redteamdevelop as a name and the second one will be the full path of our executable
file.
We already have that information inside the general information class, so we need to access this variable.
To do so, we need to create an instance of general info class inside the persistance class.
Let's do it.
I will call it newinstance.
And in order to initialize its value, let's create a new constructor.
And our constructor will take the generalinfo instance as argument.
And we will initialize our newinstance inside the constructor function.
So now we can access to executable path information via newinstance object,
epath
And we need to use two more methods for the proper coding.
It will be dispose() for releasing all resources used by the the rkInstance.
And then we need to close our key.
So we are ready.
Let's see if everything work well to do so.
Switch back to program.cs file and create a new instance of the persistence class.
I would call persObj and it will take infoObject as argument.
InfoObj is an instance of the generalinfo class.
We can call the AddtoStartUp function to see if it works or not.
Open up your terminal and type dotnet run in order to compile and execute our program.
And let's see if our executable added to start-up folder.
Open your task manager.
And under the startup tab, as you can see, red team develop is here.
So everything went well, that's it for this lecture.
See you in the next one.