Boot Logon Autostart Execution Windows Privilege Promotion


Some of the words

Through the start folder to modify, so as to achieve the relevant user rights

The Startup folder is a folder accessible from the Start menu, and once the target user logs in to his machine, the applications saved in the folder will launch directly

All user paths:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
Current user path:
C:\Users\yangsir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Actual use

Environment configuration

Enter the target path as follows

Edit permissions

Give full control

icacls

The test results are as follows

Simple to use

Add read and write permissions to progress writing to our Trojan path

Copy the file to the startup directory
shell copy C:\Users\sqladmin\Desktop\b.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shell.exe"

After confirming the login account of a user with high permission, the user directly obtains related permissions as follows


Author: Yangsir
Reprint policy: All articles in this blog are used except for special statements CC BY 4.0 reprint policy. If reproduced, please indicate source Yangsir !
  TOC