diff --git a/payloads/BackDoor/README.md b/payloads/BackDoor/README.md index 34c78de..e19f62b 100644 --- a/payloads/BackDoor/README.md +++ b/payloads/BackDoor/README.md @@ -10,3 +10,16 @@ screen and turn on remote desktop to be accessible from remote location.
**OS**: Windows 10
**User**: Admin User
**Hardware**: ATtiny85 (Chinese) + +#### 2: GoodOl' BackDoor.ino:
+Based on old sticky key backdoor trick by adding a registry key instead of replacing the file in system32 directory. After successful run press shift 5 times on login screen and command prompt will popup with admin privileges.
+ +To remove the backdoor run the following command in command prompt with admin privileges and backdoor will be removed. + +***REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe*** + +**Tested on:**
+**OS**: Windows 10/7
+**User**: Admin User
+**Hardware**: ATtiny85 (Chinese) +