Hey everybody and welcome to the next video.
We're gonna be talking about persistence.
So what is persistence.
Persistence is keeping access to the machine.
After the initial access or another word for it is back during the machine there's two different types
of persistence that I want you all to understand is clean or dirty.
Persistence now adds misspell out fix that clean persistence is normally seamless to the user.
It doesn't cause any errors or crashing.
So for example this is back drawing a deal that's commonly used instead of replacing it creating a new
service starting up an application on startup whether that's due to the registry or whether the startup
folder depending on the OS.
So examples of this are something that as long as your application runs in the background doesn't display
anything or any goodies to the screen then it's considered clean.
You're not showing the user that anything is obviously wrong.
Obviously they look up a the services they might see something new on startup that's not as obvious
to a standard user as a giant error message popping up on the screen where they start to alert admins
and then they started investigating and then now you've been found out.
So the opposite of that is dirty persistence.
Again misspelling
This is obvious to the user causes errors in crashes but should be used as a last resort.
Now trying clean persistence is going to be your go to for the most part.
Sometimes it's just not.
It just isn't feasible with what you have.
And some examples of this is just you just have to go to the last resort and just do it.
So deal out replacement so just replacing the deal upright so when it executes it you now have it execute
your executable instead of what it's actually looking for that is depending on the executable you replace
or the deal you replace you can cause massive damage or the applications might not start our entire
service sets might not start application shims and accessibility features replacing those entirely causes
a lot of problems but what's also there is any dirty persistence can be made with clean with enough
knowledge now.
That's where like I said DLR replacement instead of replacing the deal entirely.
You go ahead and hook into it or backdoor it like we talked about right there.
So if you backdoor the DSL it can run and do its normal function.
However it just also spawned a thread that executed your your code that you want.
So just understand the difference between the two and when we go through the rest of the module you'll
see various different situations where one might be used and one might not.