Introduction
Welcome again. This time we ae going to craft a PowerShell Script to bypass UAC.
In other words, we are going to use a Medium Integrity process that belongs to a Local Administrator to spawn a new High Integrity process, with all privileges available.
What is UAC?
UAC (User Account Control) is a security feature, introduced from Windows 7 and onward versions of Windows. This prevents that even a local administrator account can’t execute changes to operating system, unless the user specifically chooses to. It is very common to see desktop users working with Administrators account (not recommended, but common), so even if a Malware, using a compromised Local Administrator account, tries to change something in the registry, or create a new service in the system, UAC won’t let that happen.
Until someone found a way to bypass it. And there are a lot of UAC bypasses since Windows 7. It became so common that even Microsoft treats this kind of problem as “non-priority” security issue.
One way of checking if you are in a Medium Integrity process is to run the command whoami /priv and see if all privileges are available.
The image above depicts a medium integrity process, as you can see, it does not have all privileges.
When you start something “As Administrator”, and run whoami /priv , you will find out that there is a lot more.
How to Bypass UAC in newer Windows versions
I digged the internet for some bypass that could affect my own machine. And I found the amazing research of Oddvar Moe about exploiting microsoft “cmstp.exe” as a way to bypass UAC.
Later on, after more reading from Oddvar post, I stumbled with Tyler Applebaum powershell script that could trigger this vulnerabiity as well.
With all these information, I decided to work in this technique and develop my own, but to keep originality, I chose to code it in C#, so we can produce a PowerShell script with DLL reflection and very few strings so AMSI will have a hard time blocking it.
The resulting C# code is this one:
Name it “Source.cs”.
To compile it, use the following syntax, in a PowerShell shell that is in the same directory as this source.
Now you have this “dll” with our C# code.
To use this bypass directly from DLL, check this powershell trick:
And a high-integrity cmd.exe should pop up in your screen!
As you can see, we have gone from a non-UAC process and spawned a Administrator process!
I tested this technique with Windows 10 build 17134, version 1803 and it worked flawlessly!
Weaponizing with PowerShell
Now we go to automation. To create a PowerShell script to exploit this technique, I have used the same old DLL reflection that I always like to use.
This is enough. You can import this function and execute it like this, to spawn an elevated process:
I hope you liked to know more about this technique. Bypassing UAC is an important step when compromising Local Administrator accounts. After UAC, you can “get system” very easily.
zc00l blog
- zc00l blog
This blog have the purpose of ilustrating some of my adventures in the world of penetration testing, welcome to my world!
How to avoid UAC prompt while running powershell script
But this prompts a UAC where i have to manual click yes. then its moves further. I want to elevate the cmdlet without giving UAC prompt and continue to go ahead.
The account used to run the script has admin permission on that machine.
2 Answers 2
Besides disabling UAC — which obviously should be the last resort — you may achieve your goal with creating a ‘scheduled’ task which is set up to run elevated and trigger that task from Jenkins.
The difficulty here will be probably about how to pass information to and retrieve information from the task — maybe you can achieve that via some files of well-known paths.
See here for how to set up such a task and here for how to trigger it.
As I do not have any Jenkins installation right now I could not test it though — sry.
The problem is the switich:
That instructs Windows that you need your code to run as an Administrator.
Remove that, and Windows will stop prompting the user for administrator privileges.
Your next question might be:
But i want a standard user to be able to do things that require administrative privileges.
Sorry, that is not allowed on secure operating systems.
- if I’m a standard user
- I simply can’t just decide to be an administrator
I actually have to be granted those rights.
The 8 year old, or the corporate desktop user, can’t just become an administrator because they wrote:
They will need me, or someone from IT, to walk the 6 buildings over to type in my admin credentials — because i actually do have Administrator privileges.
Imagine Life Before UAC
Every developer complaining about UAC, who hates UAC, wants to go back to before UAC. Lets imagine that.
- It’s 2002, you’re running Windows XP SP3
- There’s no UAC, so you’re always a standard user
And you want to run some code as an Administrator.
You can’t do that; you’re a standard user.
The only solution is to:
- Fast User Switch
- and get an Administrator to login to the machine
- have them run your script
- they then logout
- and you fast-user-switch back to your own account
UAC is much better; since they can just type their credentials into the UAC dialog:
But I Just Don’t Want A UAC Prompt
You might be saying:
I don’t care about any of that. I just don’t want the UAC prompts. I want it to work like it did in Windows XP
If you don’t want the UAC prompts, and you want it to behave like it did in Windows XP: then you absolutely can do that. You are perfectly free to turn off UAC.
- Standard users will always be standard users, with no way to elevate
- Administrators will always be administrative users, with no need to elevate
And that is your preference, and you can do that.
Many other users don’t want to do their day-to-day work as an Administrator. But since you’re only running your script on your computer: it’s fine.
Bypassing UAC from a remote powershell and escalating to “SYSTEM”
This short article is a continuation of my previous one. I will focus on bypassing UAC and getting SYSTEM privileges, again without any “automated tools”, just to show you how it works and which techniques you could use. As usual, there are several ways to accomplish these tasks, so feel free to add your comments & tips.
Imagine you got reverse powershell during a client side attack. First of all let’s see who we are and where we are:
Good, we are local administrators of the machine.. which is?
Great! A Windows 2012 server, so let’s move and launch our uploaded and “obfuscated” powerhsell version of mimikatz in order to get the password, hashes, tickets etc….:
Oh no! What’s happening? We cannot get mimikatz running properly, insufficient privileges.. why? Mimikatz need SYSTEM privileges but this is not an issue for administrators group which have the same privileges, so why?
Re-introducing UAC … yes when UAC is enabled, applications runs under normal user context until you explicitly allows them to run in a more privileged one, and only after confirming thin annoying message:
But we have only our “raw” powershell, no way to interact with desktop, so how can we bypass UAC (… yes there are many ways…)
A quick google search revealed a lot of “UAC Bypass” PS script for all windows versions and, after some testing, we decided to use this one:
This one is very useful because it allows us to specify our custom payload, we will see this later.
Invoke-PsUACme has several bypass techniques and supports many versions including Windows 2012 and 10.
Again, after some tests, we went for “Windows Out of Box Experience” method (OOBE)
This will be we our attack strategy:
1 – First of all, we create a script (reverse.ps1) with our new reverse shell connecting back to port 80 and upload it on the target server :
2 – Upload the “Invoke-PsUACme.ps1” on target server (I described in the previous article how to accomplish this task) .
Remember to stop apache and do an “nc -lvp 80” on your Linux box ��
3 – In our exiting powershell let’s invoke the “magic” commands:
The first instruction loads the ps1 script in our powershell context (. is an alias for import-module)
Then we call the function Invoke-PsUACme with method oobe and with our payload which will launch a new powershell executing our script “reverse.ps1”
Fingers crossed.. and in your new terminal we should get back a connection from our victim:
Fine .. and now let’s try to launch again mimikatz…
Bingo.. we elevated our privileges and bypassed UAC!
Last but not least, if you got the shell on Windows 10 Anniversary edition, don’t miss this fantastic tool to bypass UAC:
Name already in use
PowerShell-Suite / Bypass-UAC / README.md
- Go to file T
- Go to line L
- Copy path
- Copy permalink
- Open with Desktop
- View raw
- Copy raw contents Copy raw contents
Copy raw contents
Copy raw contents
Bypass-UAC provides a framework to perform UAC bypasses based on auto elevating IFileOperation COM object method calls. This is not a new technique, traditionally, this is accomplished by injecting a DLL into «explorer.exe». This is not desirable because injecting into explorer may trigger security alerts and working with unmanaged DLL’s makes for an inflexible work-flow.
To get around this, Bypass-UAC implements a function which rewrites PowerShell’s PEB to give it the appearance of «explorer.exe». This provides the same effect because COM objects exclusively rely on Windows’s Process Status API (PSAPI) which reads the process PEB.
Bypass-UAC is self-contained and does not have any dependencies, bar a requirement that the target have PowerShell v2.
- UacMethodSysprep: Original technique by Leo Davidson (sysprep -> cryptbase.dll)
- Targets: x32/x64 Windows 7 & 8
- Targets: x64 Win7+ (currently unpatched)
- Targets: x64 Win7+ (currently unpatched)
- Targets: x32/x64 Win7+ (UAC «0day» ¯_(ツ)_/¯)
- Targets: x32/x64 Win7+ (UAC «0day» ¯_(ツ)_/¯)
Win 7 Pro
Win 10 Pro
By @mattifestation, allows you to easily define in-memory enums, structs, and Win32 functions. This is necessary because it allows PowerShell to use the Windows API without compiling c# at runtime. Doing that is ok most of the time but it writes temporary files to disk and won’t work if csc is blacklisted.
A modified version of Masquerade-PEB, changed to use PSReflect. This function overwrites PowerShell’s PEB to impersonate «explorer.exe».
Load a .NET dll into memory which exposes an IFileOperation COM object interface to PowerShell. This is based on work done by Stephen Toub, published in the December 2007 MSDN magazine (I added the pages in the images folder for reference). Further details available in the FileOperations folder.
Bootstrap function which writes an x32/x64 bit proxy dll to disk (Yamabiko). This dll is based on fubuki from @hfiref0x’s UACME project. Mostly I stripped out the redundant functionality and did some minor renaming for AV evasion. Further details available in the Yamabiko folder.
Currently there are five methods in Bypass-UAC, I will add more gradually but it would be awesome if people want to contribute. It is really easy to add a new method, provided you need an elevated file copy/move/rename or folder creation. A sample method can be seen below for reference.
Similarly, using EXPORTSTOC++ you can easily copy/paste exports into Yamabiko to target new binaries!
This project is for authorized use only, that goes without saying, I don’t take responsibility for foolish people doing bad things!