3

A recent report on page 18 states that:

[black hats] have even leveraged [systems administration tools] as a means of maintaining additional persistence via setting “sticky keys” for RDP sessions.

How is sticky keys abused in this manner, and how do I detect or prevent its exploitation? Is setting a group policy to disable this feature enough?

  • The author does not explain themselves, so it is a little difficult to answer your question about how they did it. – schroeder Oct 30 '14 at 14:28
  • maintaining additional persistence in other words, the machine was already hacked at a system level and they're just providing a way back in. – Fiasco Labs Dec 14 '14 at 22:27
2

Malware/rootkit and other malicious techniques are reported to use the old-but-reliable“sticky keys” technique, whereby “sethc.exe” is overwritten with a copy of “cmd.exe” to provide unauthenticated access during RDP logon,http://windowspwnage007.blogspot.in/ ,one example is Hikit Rootkit,https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/, We also know that we cant replace sethc.exe with Admin privileges Unless we gain Take Ownership privilage or trusted Installer privilege

Group Policy cannot save us from these malicious attacks as attackers often install malicious software and thus have trusted installer privileges which can easily change registry and Group policy

Edit

Microsoft Windows protection Like code signing which authenticates that code or app came from trusted publisher i.e Microsoft this prevents tampering the app since it is code signed,Further File and Registry Virtualization and UAC stops your installer from writing to protected folders like System32,you can see this when your installer tries to write to system32 or HKLM registry key , the writes are redirected to different location and installer believes that it has written to system32 which it has not, researching about this i came to conclusion that Malware first gains Debug privileges so that it is authorized to inject code into high privileged application,then it gains other privileges and also changing Manifest of application is hard as publisher i.e Microsoft signs it but after it gains super privileges like debug privileges it can do anything

  • 1
    You can try and setup a virtual environment where you install windows 7 or xp on virtualbox and then replace sethc.exe with cmd.exe,Later you can RDP the Guest VM via your Host OS and then press shift key 5 times you will get NT Authority /SYSTEM access Via your RDP session. – raven Nov 14 '14 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.