mirror of
https://github.com/FunnyWolf/Viper.git
synced 2026-10-29 04:16:51 +08:00
21 lines
840 B
Markdown
21 lines
840 B
Markdown
# Winlogon Helper DLL Persistence
|
|
|
|
## Main Functions
|
|
Achieve persistence through HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
|
|
|
|
## Precautions
|
|
It is not undetectable and requires administrator privileges.
|
|
|
|
## Operation Methods
|
|
- Generate a listener.
|
|
- Obtain a Session with administrator privileges.
|
|
- Run the module and fill in the listener configuration.
|
|
|
|
|
|
|
|
- Caching the listener means that after the module runs successfully, a virtual listener will be automatically generated according to the filled listener parameters, which is convenient for restoration when the server restarts.
|
|
- Module execution results
|
|
|
|
|
|
|
|
- After the target machine restarts, any user login will execute userinit.exe and regenerate a Session. |