Place persistence on a VM you own, and record every mechanism

short · 55 min · Objective 5.1

Task

Establish persistence on a lab VM you built by a few different mechanisms, recording each one as you place it, and observe what a defender hunting for it would see — because a tester needs persistence for a bounded time, and every mechanism placed must be in the cleanup list from the moment it exists.

Steps

  1. On the lab you own, take a VM where you already have the needed access, and snapshot it.
  2. Place persistence by two or three mechanisms — a scheduled task, a service, a startup entry, or an account/key-based method.
  3. Record each mechanism in /tmp/persistence.md as you place it: mechanism:, where it lives, and how to remove it. This is the cleanup list starting.
  4. Reboot the VM and confirm each mechanism survives — that is what persistence means.
  5. Enable logging and record what a defender hunting for persistence would see for each mechanism.
  6. Remove every mechanism from your list, then revert the snapshot as a backstop.

Verify

grep -cE "^mechanism:" /tmp/persistence.md
grep -cE "^(location|removal):" /tmp/persistence.md
grep -ciE "survived|after reboot|persisted" /tmp/persistence.md

The first count must be at least 2 — you placed multiple mechanisms. The second must be non-zero: each carries where it lives and how to remove it, which is the cleanup list written at the moment of change rather than reconstructed at the end. The third must be non-zero: you confirmed persistence survived a reboot, which is the property being demonstrated.

Notes

A tester needs persistence for the duration of the engagement and no longer, and every mechanism placed goes on the cleanup list the instant it exists — reconstructing it later from memory is how an access mechanism gets left behind, the worst outcome in this course. What persistence looks like to a defender hunting for it is the finding's other half. Everything ran on a disposable VM you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.