4.USERINIT注册键： 位于：[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit...5.EXPLORER\RUN注册键： 位于： [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer...\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 描述：...\RunServicesOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce...\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 描述：紧跟在
无意间发现还有另一个，豁然开朗 原因：允许锁屏的注册表被禁用了，涉及2个键值（我实测的时候是不需要重启和注销的，执行完就生效了） reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v DisableLockWorkstation /d 0 /t REG_DWORD /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...\Winlogon" /v DisableLockWorkstation reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies...\System" /v DisableLockWorkstation reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Authentication...\Winlogon" /v DisableLockWorkstation reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
R字母键，在打开的运行窗口中输入regedit，然后按回车键(Enter键)，再复制粘贴定位到下面选项： HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...按照上面第二小节的方法，进入注册表，下面的代码就分别代表了不同的快捷方式，按需删除即可： 1）下载文件夹： ［-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}］ 2）图片文件夹： ［-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...、桌面”六个文件夹批量删除： Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...音乐、桌面”六个文件夹批量创建： Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
然后双击执行会导入到windows注册表； 然后打开注册表，win徽标键+R，输入regedit，在最上面输入计算机\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...以下代码是需要保存为 .reg的内容： Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...\Explorer\ShellIconOverlayIdentifiers] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
禁用任务管理器 //禁用 var subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion..."1"); //启用 RegistryKey subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion...禁用注册表（测试无效） //禁用 var subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion..."1"); //启用 RegistryKey subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion...Test.exe"); //恢复 RegistryKey subKey = Registry.LocalMachine.CreateSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion
start= auto sc delete ServiceTest 3、自启动注册表加载 -当前用户键值 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion...\Run -服务器键值（需要管理员权限） HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run -添加启动项 REG ADD..."HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "backdoor" /t REG_SZ /F /D "C:\shell.exe"...sethc.exe 本质还是进行程序替换 权限维持-域环境&单机版-映像劫持 测试：执行notepad成cmd REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512 reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...\Internet Settings" /v ProxyServer /d "" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet...\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...将下面文件保存为OFF.BAT @echo off echo 正在清空代理服务器设置…… reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...\Internet Settings" /v ProxyServer /d "" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
位置：HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows\load。 ...\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce。 ...\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices。 ...\RunOnce和HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce。...\SOFTWARE\Microsoft\Windows\CurrentVersion\Run。
\SetCommand=4,0 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,"10..." MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0 MACHINE\Software...NT\CurrentVersion\Winlogon\ScRemoveOption=1,"0" MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies...\CurrentVersion\Policies\System\EnableSecureUIAPaths=4,1 MACHINE\Software\Microsoft\Windows\CurrentVersion...\Windows\CurrentVersion\Policies\System\ScForceOption=4,0 MACHINE\Software\Microsoft\Windows\CurrentVersion
//添加信任站点(http://127.0.0.1) WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion...Range100\\:Range","127.0.0.1"); WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion...IE ActiveX安全设置: 1本地Intranet区域 WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion...//修改IE ActiveX安全设置:2受信任的站点区域 WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion.../修改IE ActiveX安全设置:3Internet区域 WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Pentestlab /t REG_SZ /d..."C:\Users\pentestlab\pentestlab.exe" reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion...reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Pentestlab /t REG_SZ /d...\Microsoft\Windows\CurrentVersion\Debug ?...HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
Editor Version 5.00 ;如需还原去除上语句前减号即可 ;取消我的电脑"视频"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}] ;取消我的电脑"文档"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...d3162b92-9365-467a-956b-92703aca08af}] ;取消我的电脑"桌面"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...B4BFCC3A-DB2C-424C-B029-7FE99A87C641}] ;取消我的电脑"音乐"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}] ;取消我的电脑"下载"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
YunJing\log\*" 2>$null 1>$null #【第6段处理部分注册表】 powershell reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion.../v StateFlags6550 /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion...Files" /v StateFlags6550 /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion.../v StateFlags6550 /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion...Cloudbase Solutions" /f 2>&1 > $null reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
NoFolderOptions -> 0x01 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoClose...-> 0x01 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer StartMenuLogOff -> 0x01...HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoFind -> 0x01 删除键值 HKLM\SOFTWARE...\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL 使得系统中无法查看隐藏文件，无法关闭与注销系统，无法打开...并添加以下两处注册表值: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system legalnoticecaption ->
开机后需要等待几十秒甚至一两分钟然后网才能通的详细情况如何配置自动登录（密码写自己的）reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion...DefaultPassword DontDisplayLastUserName LastUsedUsername"reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v "AutoAdminLogon" /d "1" /t REG_SZ /freg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v DontDisplayLastUserName /t REG_SZ /d 0 /freg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...-FilePath "cmd.exe" -ArgumentList "/c reg query `"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
UserName").SetPassword("$NewPassword") reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion...DefaultPassword DontDisplayLastUserName LastUsedUsername" reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v "DefaultPassword" /d "密码" /t REG_SZ /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v "AutoAdminLogon" /d "1" /t REG_SZ /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v DontDisplayLastUserName /t REG_SZ /d 0 /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
1.禁止开始菜单上的上下拖动 在 HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer下新建一个名为...6.在“运行”中添加“在单独的内存空间中运行”的选项 在 HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer...（仅限于NTFS格式硬盘） 在 HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer下新建一个名为...（仅限于NTFS格式硬盘） 在 HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer下新建一个名为...二、修改桌面设置 1.隐藏桌面的所有图标 在 HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer
领取专属 10元无门槛券
手把手带您无忧上云
云服务器
ICP备案
实时音视频
即时通信 IM
对象存储
