4.USERINIT注册键： 位于：[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit...5.EXPLORER\RUN注册键： 位于： [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer...\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 描述：...\RunServicesOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce...\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 描述：紧跟在
无意间发现还有另一个，豁然开朗 原因：允许锁屏的注册表被禁用了，涉及2个键值（我实测的时候是不需要重启和注销的，执行完就生效了） reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v DisableLockWorkstation /d 0 /t REG_DWORD /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...\Winlogon" /v DisableLockWorkstation reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies...\System" /v DisableLockWorkstation reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Authentication...\Winlogon" /v DisableLockWorkstation reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies
R字母键，在打开的运行窗口中输入regedit，然后按回车键(Enter键)，再复制粘贴定位到下面选项： HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...按照上面第二小节的方法，进入注册表，下面的代码就分别代表了不同的快捷方式，按需删除即可： 1）下载文件夹： ［-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...NameSpace\{088e3905-0323-4b02-9826-5d99428e115f}］ 2）图片文件夹： ［-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...、桌面”六个文件夹批量删除： Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...音乐、桌面”六个文件夹批量创建： Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
然后双击执行会导入到windows注册表； 然后打开注册表，win徽标键+R，输入regedit，在最上面输入计算机\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...以下代码是需要保存为 .reg的内容： Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...\Explorer\ShellIconOverlayIdentifiers] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
禁用任务管理器 //禁用 var subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion..."1"); //启用 RegistryKey subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion...禁用注册表（测试无效） //禁用 var subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion..."1"); //启用 RegistryKey subKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion...Test.exe"); //恢复 RegistryKey subKey = Registry.LocalMachine.CreateSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion
start= auto sc delete ServiceTest 3、自启动注册表加载 -当前用户键值 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion...\Run -服务器键值（需要管理员权限） HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run -添加启动项 REG ADD..."HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "backdoor" /t REG_SZ /F /D "C:\shell.exe"...sethc.exe 本质还是进行程序替换 权限维持-域环境&单机版-映像劫持 测试：执行notepad成cmd REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512 reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\SetCommand=4,0 MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,"10..." MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0 MACHINE\Software...NT\CurrentVersion\Winlogon\ScRemoveOption=1,"0" MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies...\CurrentVersion\Policies\System\EnableSecureUIAPaths=4,1 MACHINE\Software\Microsoft\Windows\CurrentVersion...\Windows\CurrentVersion\Policies\System\ScForceOption=4,0 MACHINE\Software\Microsoft\Windows\CurrentVersion
\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...\Internet Settings" /v ProxyServer /d "" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet...\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...将下面文件保存为OFF.BAT @echo off echo 正在清空代理服务器设置…… reg add "HKCU\Software\Microsoft\Windows\CurrentVersion...\Internet Settings" /v ProxyServer /d "" /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Editor Version 5.00 ;如需还原去除上语句前减号即可 ;取消我的电脑"视频"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}] ;取消我的电脑"文档"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...d3162b92-9365-467a-956b-92703aca08af}] ;取消我的电脑"桌面"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...B4BFCC3A-DB2C-424C-B029-7FE99A87C641}] ;取消我的电脑"音乐"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}] ;取消我的电脑"下载"文件夹 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
位置：HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows\load。 ...\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce。 ...\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices。 ...\RunOnce和HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce。...\SOFTWARE\Microsoft\Windows\CurrentVersion\Run。
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Pentestlab /t REG_SZ /d..."C:\Users\pentestlab\pentestlab.exe" reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion...reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v Pentestlab /t REG_SZ /d...\Microsoft\Windows\CurrentVersion\Debug ?...HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NoFolderOptions -> 0x01 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoClose...-> 0x01 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer StartMenuLogOff -> 0x01...HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoFind -> 0x01 删除键值 HKLM\SOFTWARE...\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL 使得系统中无法查看隐藏文件，无法关闭与注销系统，无法打开...并添加以下两处注册表值: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system legalnoticecaption ->
;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion...;[Console]::Readkey() | Out-Null;exit" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
//添加信任站点(http://127.0.0.1) WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion...Range100\\:Range","127.0.0.1"); WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion...IE ActiveX安全设置: 1本地Intranet区域 WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion...//修改IE ActiveX安全设置:2受信任的站点区域 WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion.../修改IE ActiveX安全设置:3Internet区域 WshShell.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion
ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion...ShowSecondsInSystemClock /t REG_DWORD /d 1 /f 2>nul 1>nul reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
Windows会默认执行的相关注册表： HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER...\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion...\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 3、自启动服务目录 HKEY_LOCAL_MACHINE...\CurrentVersion\RunServicesOnce HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices...\CurrentVersion\Explorer\ShellFolders HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
YunJing\log\*" 2>$null 1>$null #【第6段处理部分注册表】 powershell reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion.../v StateFlags6550 /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion...Files" /v StateFlags6550 /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion.../v StateFlags6550 /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion...Cloudbase Solutions" /f 2>&1 > $null reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
该方式会在HKCU\Software\Microsoft\Windows\CurrentVersion\Run下添加注册表信息。推荐使用该参数；-X：设置后门在系统启动后自启动。...该方式会在HKLM\Software\Microsoft\Windows\CurrentVersion\Run下添加注册表信息。由于权限问题，会导致添加失败，后门将无法启动。...\Run\ HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ ?...注册表还有哪些键值可以设置为自启动： HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\...SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
开机后需要等待几十秒甚至一两分钟然后网才能通的详细情况如何配置自动登录（密码写自己的）reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion...DefaultPassword DontDisplayLastUserName LastUsedUsername"reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v "AutoAdminLogon" /d "1" /t REG_SZ /freg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...\Winlogon" /v DontDisplayLastUserName /t REG_SZ /d 0 /freg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion...-FilePath "cmd.exe" -ArgumentList "/c reg query `"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
领取专属 10元无门槛券
手把手带您无忧上云
云服务器
ICP备案
对象存储
实时音视频
即时通信 IM
