
You have achieved Domain Admin access during an authorized penetration test. Reason through Kerberos ticket forgery for long-term persistence.

**Golden Ticket**
- What is a Golden Ticket and what does it allow you to do?
- What do you need to create a Golden Ticket? (KRBTGT hash, domain SID, domain name)
- How long does a Golden Ticket remain valid after a KRBTGT password rotation?
- Why do defenders need to rotate the KRBTGT account password TWICE to invalidate existing tickets?

**Silver Ticket**
- What is a Silver Ticket and how does it differ from a Golden Ticket?
- What service account hash do you need for a Silver Ticket targeting CIFS vs HTTP vs MSSQLSvc?
- Why is a Silver Ticket harder to detect than a Golden Ticket?

**Diamond & Sapphire Tickets**
- What makes Diamond and Sapphire Tickets more evasive than Golden Tickets?
- How does a Diamond Ticket modify a legitimately issued TGT vs create one from scratch?

**Operational Considerations**
- How do you pass a forged ticket into your current session on Windows?
- How do you use a forged ticket with Linux tooling? (impacket ticketer)
- What event log IDs should defenders monitor for ticket anomalies?

**Persistence Value**
- Why is a Golden Ticket considered "persistent" even though it is a ticket, not a backdoor?
- How does Golden Ticket persistence survive password changes?
- What is the only reliable way for defenders to invalidate an existing Golden Ticket?

Output:
- Golden vs. Silver vs. Diamond Ticket comparison table
- Creation commands for each (Mimikatz + impacket)
- Defender detection events and mitigation


Golden & Silver Ticket Persistence


You have achieved root access on a Linux server during an authorized penetration test. Evaluate and reason about persistence mechanisms.

**Cron & Scheduled Jobs**
- Where are cron jobs stored and which locations persist across user changes?
- How do you add a cron job for root that survives system reboots?
- What is the detection profile of a cron-based reverse shell?

**User & Authentication Persistence**
- How do you add a backdoor user that blends with existing accounts?
- What does modifying `/etc/passwd` and `/etc/shadow` allow you to do?
- How do SSH authorized_keys persistence work and why is it common?
- What is PAM and how can it be abused for credential capture?

**Service-Based Persistence**
- How do you create a malicious systemd service that auto-starts?
- What does a simple systemd unit file for a reverse shell look like?
- What are init.d scripts and do they still apply to modern Linux distributions?

**Binary & Library Hijacking**
- What is LD_PRELOAD hijacking and how can it be used for persistence?
- How does PATH hijacking work for privilege escalation and persistence combined?
- What is SUID binary replacement and what are its risks?

**Log Evasion**
- Where are authentication events logged on Linux?
- How do you modify timestamps and clean log entries?
- What does UTMP/WTMP record and how can it be manipulated?

Output:
- Persistence mechanism comparison: stealth vs. reliability vs. effort
- Detection artifacts per technique
- Systemd service unit file template for testing


Linux Persistence Mechanisms


You have achieved code execution on a web server during an authorized penetration test. Evaluate persistence through the web application layer.

**Web Shell Types**
- What is the difference between a simple command web shell, a feature-rich shell (like b374k), and a callback shell?
- What file extensions are interpreted by common web servers? (.php, .aspx, .jsp, .cfm)
- How do you obfuscate a PHP web shell to avoid signature detection?

**Placement Strategy**
- Where should a web shell be placed to maximize persistence and minimize detection?
- How do you mimic legitimate file names, timestamps, and permissions?
- What is the risk of placing a shell in a version-controlled directory vs outside the web root?

**Callback & C2 From Web Shells**
- How do you upgrade from a web shell to a reverse shell?
- What firewall bypass techniques work for outbound connections from a web server?
- How do you use a web shell to stage additional tools without writing to disk?

**Application-Layer Backdoors**
- How can you backdoor a PHP application's authentication function to accept a master password?
- How do you add a route to a web framework (Laravel, Django, Express) that provides backdoor access?
- How can a cron job at the application level maintain persistence if the web shell is removed?

**Detection & Removal**
- What tools do defenders use to find web shells?
- How do content integrity checks work and how do you survive them?
- What artifacts does a web shell leave in access and error logs?

Output:
- Web shell placement decision matrix
- Simple obfuscated PHP shell template
- Persistence survival checklist


Web Shell & Application Persistence


You have SYSTEM or Administrator access on a Windows host during an authorized penetration test. Reason through persistence options.

**Registry-Based Persistence**
- What are the most commonly used registry Run keys and who does each affect?
- What is the difference between HKCU Run and HKLM Run from an attacker's perspective?
- What do Image File Execution Options (IFEO) enable and how are they abused?
- What is the Winlogon Userinit and Shell registry value and how is it abused?

**Scheduled Tasks**
- How do you create a scheduled task that runs at login vs at system boot?
- What task trigger types are least monitored by defenders?
- How does a COM hijack through scheduled tasks work?

**Service Persistence**
- How do you create a Windows service for persistence?
- What is the difference in stealth between a new service and modifying an existing service's binary path?
- Which built-in services are commonly abused for binary path modification?

**Startup Locations**
- What are all the startup folder locations per-user and system-wide?
- How does the Startup folder differ between Windows 10 and Windows Server environments?

**Advanced Techniques**
- What is a DLL side-loading and how is it used for persistence?
- What are Boot or Logon Autostart Execution locations beyond the obvious ones? (AppInit_DLLs, LSA notification packages, WinSock)
- What is COMhijacking and why is it harder to detect?

Output:
- Registry run key list with persistence type and detection risk
- Scheduled task creation command with minimal detection footprint
- Detection opportunities per technique


Persistence

Golden & Silver Ticket Persistence

Linux Persistence Mechanisms

Web Shell & Application Persistence

Windows Persistence Techniques