From b7eb81216b88f6272ca32913055744c2f3f8d6aa Mon Sep 17 00:00:00 2001 From: Muhammad Talha Khan Date: Fri, 31 May 2019 23:45:05 +0500 Subject: [PATCH] Update README.md --- payloads/BackDoor/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/payloads/BackDoor/README.md b/payloads/BackDoor/README.md index 34c78de..e19f62b 100644 --- a/payloads/BackDoor/README.md +++ b/payloads/BackDoor/README.md @@ -10,3 +10,16 @@ screen and turn on remote desktop to be accessible from remote location.
**OS**: Windows 10
**User**: Admin User
**Hardware**: ATtiny85 (Chinese) + +#### 2: GoodOl' BackDoor.ino:
+Based on old sticky key backdoor trick by adding a registry key instead of replacing the file in system32 directory. After successful run press shift 5 times on login screen and command prompt will popup with admin privileges.
+ +To remove the backdoor run the following command in command prompt with admin privileges and backdoor will be removed. + +***REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe*** + +**Tested on:**
+**OS**: Windows 10/7
+**User**: Admin User
+**Hardware**: ATtiny85 (Chinese) +