Sticky Keys Persistence
- by Vince
-
in Blog
-
Hits: 393
There's a function in Windows, Accessibility Options, which is available for the visually impaired. Basically, at the login prompt, we can hit the Shift key five times and that will activate sethc.exe. But let's say we want to abuse this prelogin function, we could copy cmd.exe in its place which would launch a command prompt, as SYSTEM, prior to login. From there, we would create an account or perform any other privilege command prompt function.