Sticky Keys and Utilman RDP Backdoor – Pre-Auth SYSTEM Shell

Windows accessibility features — Sticky Keys (sethc.exe), Utility Manager (utilman.exe), and others — are invokable from the RDP login screen before any user authenticates. They run as SYSTEM. Replacing these binaries with cmd.exe, or redirecting them via a registry debugger key, gives you a SYSTEM shell accessible from the RDP login screen on every subsequent connection — no credentials required.

This is a persistence technique. You need admin or SYSTEM on the host first to plant it. The payoff is re-entry: if your credentials are rotated or your current session is lost, you can return to the host and get a SYSTEM shell from the login screen alone.

Method 1 – Registry Debugger Hijack (Preferred)

The Image File Execution Options (IFEO) debugger key causes Windows to launch a specified binary whenever a target executable is invoked. This avoids replacing the original binary on disk, making it slightly less obvious than direct replacement and easier to remove.

Backdoor utilman.exe to launch cmd.exe instead:

Backdoor sethc.exe:

Plant both for redundancy. Trigger from the RDP login screen:

• utilman.exe: Press Windows Key + U at the login screen

• sethc.exe: Press Shift five times at the login screen

A SYSTEM cmd.exe window opens over the login screen. From there you can add users, reset passwords, or execute any payload:

Method 2 – Binary Replacement

Direct replacement is more reliable on older Windows versions where IFEO is not processed for accessibility features:

Take ownership of the binary and grant write access:

For utilman.exe:

On Windows 10 and Server 2016+, Windows File Protection may restore the original binary. The IFEO registry method is more resilient on modern targets.

Other Backdooring Targets

Any accessibility binary invokable from the login screen works. Additional options:

Backdoor multiple targets to increase the chance one survives patching or cleanup:

Dropping a Reverse Shell Instead of cmd.exe

Instead of pointing the debugger key at cmd.exe, point it at a hosted payload for a callback shell:

Place your payload at C:\Windows\Temp\shell.exe first. When the login screen trigger fires, your payload executes as SYSTEM and calls back to your listener:

PowerShell One-Liner

For quick deployment from a PowerShell session:

Cleanup

Remove both keys after the engagement:

If you used binary replacement, restore the originals from the Windows install media or a known-good copy before cleaning up.