Hunting Sticky Keys Backdoors

Mon, 23 Mar 2015 00:00:00 +0000

The “sticky keys” backdoor method has been a favorite for hackers for years and it’s been gaining popularity as a malware-free persistence method. This backdoor method gives an attacker pre-authentication, SYSTEM-level access to a target remotely over RDP or locally via the console.

The backdoor can be installed in one of two ways:

Copy cmd.exe over sethc.exe or utilman.exe
Set cmd.exe as the debugger for sethc.exe or utilman.exe

The sethc.exe backdoor can be triggered by pressing the shift key five times in rapid succession. The utilman.exe backdoor can be triggered by pressing windows+u.

Persistence on Zach Grace

Hunting Sticky Keys Backdoors