Table of Contents
What Is a Persistent Payload and How Does It Maintain Access After a Reboot?
Explore the concept of a persistent payload in Metasploit and ethical hacking. Learn how these mechanisms ensure continuous access to a target system even after a reboot by modifying startup processes, services, or registry keys.
Question
Which type of payload maintains continuous access even after a system reboot?
A. Staged payload
B. Persistent payload
C. Inline payload
D. Reverse TCP payload
Answer
B. Persistent payload
Explanation
Persistent payloads are designed to re-establish access even after reboot.
A persistent payload refers to a payload that has been installed on a target system with a mechanism that allows it to automatically execute again after the system is rebooted. Persistence is not a type of payload itself (like staged or inline) but rather a characteristic or a goal achieved through post-exploitation techniques. After gaining initial access with a payload like Meterpreter, an attacker will run scripts or modules that modify the target’s system configuration. These modifications ensure that the payload or a stager for it is launched every time the system starts up.
Common persistence techniques include:
- Creating a new service that runs at boot.
- Adding a program to the startup folder.
- Creating a scheduled task.
- Modifying registry keys like HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
The other options refer to different aspects of payloads:
A. Staged payload: This describes a delivery method where a small initial “stager” connects back to the attacker and downloads the rest of the larger, more functional payload. This is about efficiency, not persistence.
C. Inline payload: Also called a stageless payload, this is a self-contained payload that includes all necessary code in a single package. It is about delivery method, not persistence.
D. Reverse TCP payload: This describes a communication method where the compromised target initiates a connection back to the attacker’s machine. This is useful for bypassing firewalls but has no bearing on what happens after a reboot.
Ethical Hacking with Metasploit, SQL & Crypto certification exam assessment practice question and answer (Q&A) dump including multiple choice questions (MCQ) and objective type questions, with detail explanation and reference available free, helpful to pass the Ethical Hacking with Metasploit, SQL & Crypto exam and earn Ethical Hacking with Metasploit, SQL & Crypto certificate.