How to create and delete hidden accounts in the system

How to create and delete hidden accounts in the system When a hacker invades a host, he will try to protect his "labor results", so it will be in the meat /The chickens leave behind a variety of back doors to control the meat/chicken for a long time, the most used of which is account hiding technology. Create a hidden account on the meat/chicken for use when needed. Account hiding technology can be described as the most hidden back door. It is difficult for general users to find the existence of hidden accounts in the system, so it is very harmful. This article reveals the techniques commonly used by hackers to hide accounts. Before hiding the system account, it is necessary to first understand how to view the existing accounts in the system. In the system, you can go to the “Command Prompt”, the “Management” of the Control Panel, “Registry”, and the existing account is only viewed at the “Command Prompt”. And "Computer Management" check for any anomalies, so how to hide the system account in the two will be the focus of this article. First, the conspiracy in the "command prompt" In fact, the production system hidden account is not very advanced technology, using the "command prompt" we often use, you can make a simple hidden account. Click “Start”→“Run”, enter “CMD"Run“command prompt", enter “net user kao$ 123456 /add”, Enter, after success, the “ command will be displayed Successful completion & rdquo;. Then enter “net localgroup administrators kao$ /add” Enter, so we use the "Command Prompt" to successfully create a user named "kao$", the password is "single" "123456” simple &ldquo ; hide the account & rdquo;, and promote the hidden account to administrator privileges. Create a simple hidden account Let's see if the creation of a hidden account is successful. Enter the command to view the system account “net user” in the “Command Prompt”, and the account that exists in the current system will be displayed after the return. From the returned results we can see that the account we just created is “kao$” this account does not exist. Then let's go to the Control Panel's "Administrative Tools" and open the "Computers" to see the "Local Users and Groups". In the "Users" section, we created a hidden account. “kao$”Exposure. The conclusion that can be concluded is that this method can only hide the account in the “Command Prompt”, but there is nothing to do with “Computer Management”. So this method of hiding accounts is not very practical, only effective for those careless administrators, is an entry-level system account hiding technology. Second, in the "registry" registry account hidden from the above we can see that the shortcomings of using the command prompt to hide the account is very obvious, it is easy to expose yourself. So is there any technology that can hide accounts at the same time in the "Command Prompt" and "Computer Management"? The answer is yes, and all this requires us to do a little in the "registry" With a small setup, the system account can be completely evaporated in both. 1, the peak loop, give the administrator registry operation authority to operate the key value of the system account in the registry, you need to modify the "HKEY_LOCAL_MACHINESAMSAM", but when we come to the place, you will find that you can not expand the location Key value. This is because the system defaults to the system administrator to "write D AC" and "read control" permissions, no modification rights, so we have no way to view and modify the key values ​​under the "SAM" . However, we can give the administrator permission to modify it by means of another "Registry Editor" in the system. Click “Start”→“Run”, enter “regedt32.exe” and press Enter, then another "Registry Editor" will be popped up, and we usually use the "Registry Editor" & rdquo; The difference is that it can modify the system account permissions when operating the registry (for ease of understanding, hereinafter referred to as regedt32.exe). In regedt32.exe, go to “HKEY_LOCAL_MACHINESAMSAM”, click “Security"Menu →"Permissions", in the pop-up "SAM Permissions" edit window, select “administrators” account, below Check the “Permission Control” checkbox, and click ““OK” to complete. Then we switch back to “ Registry Editor & rdquo;, you can find that the key values ​​below "HKEY_LOCAL_MACHINESAMSAM & rdquo; can be expanded. Hint: The methods mentioned above are only available for Windows NT/2000 systems. In the Windows XP system, the operation of the permission can be directly performed in the registry by selecting the item that needs to be set, right-clicking, and selecting “Permissions”