Bypassing UAC With UACMe
Last updated
Was this helpful?
Last updated
Was this helpful?
User Account Control (UAC) is a Windows security feature introduced in Windows Vista that is used to prevent unauthorized changes from being made to the operating system.
UAC is used to ensure that changes to the operating system require approval from the administrator or a user account that is part of the local administrators group.
A non-privileged user attempting to execute a program with elevated privileges will be prompted with the UAC credential prompt, whereas a privileged user will be prompted with a consent prompt.
Attacks can bypass UAC in order to execute malicious executables with elevated privileges.
In order to successfully bypass UAC, we will need to have access to a user account that is a part of the local administrators group on the Windows target system.
UAC allows a program to be executed with administrative privileges, consequently prompting the user for confirmation.
UAC has various integrity levels ranging from low to high, if the UAC protection level is set below high, Windows programs can be executed with elevated privileges without prompting the user for confirmation.
There are multiple tools and techniques that can be used to bypass UAC, however, the tool and technique used will depend on the version of Windows running on the target system.
UACMe is an open source, robust privilege escalation tool developed by @hfire0x. It can be used to bypass Windows UAC by leveraging various techniques.
The UACME GitHub repository contains a very well documented list of methods that can be used to bypass UAC on multiple versions of Windows ranging from Windows 7 to Windows 10.
It allows attackers to execute malicious payloads on a Windows target with administrative/elevated privileges by abusing the inbuilt Windows AutoElevate tool.
The UACMe GitHub repository has more than 60 exploits that can be used to bypass UAC depending on the version of Windows running on the target.
Identify Vulnerable Rejetto Version: Confirm that the target server is running a vulnerable version of Rejetto (HTTP File Server).
Exploit Using Metasploit:
Module: exploit/windows/http/rejetto_hfs_exec
Commands:
Outcome: Obtain a Meterpreter shell in a 32-bit (x86) environment.
Identify the "explorer" Process ID:
Command:
Find Process ID: Look for the explorer.exe process, which is usually a 64-bit process.
Migrate to a 64-bit Process:
Command:
Outcome: Transition from a 32-bit (x86) Meterpreter shell to a 64-bit (x64) Meterpreter shell.
After successfully exploiting the Rejetto vulnerability and obtaining a Meterpreter shell, you might encounter a User Account Control (UAC) prompt when trying to execute administrative commands. To bypass this prompt and elevate your privileges, follow these detailed steps:
Download UACMe Tool:
Tool: UACMe
Purpose: This tool helps bypass the UAC prompt by leveraging specific Windows features and settings.
Create Shell Code:
Definition: Shell code is a piece of code that performs specific actions on the target system. In this case, you will use a Meterpreter shell code that opens a connection back to your listener with elevated privileges.
Shell Code: This is a payload that you will upload to the target system and execute to establish a new Meterpreter session with administrative rights.
Example:
Shell Code Generation:
Upload UACMe and Shell Code to Target System:
Commands:
Navigate to UACMe Directory:
Command:
Run UACMe to Perform UAC Bypass:
Command:
Explanation:
UACMe uses the shell code you provided to execute a new Meterpreter session as an administrator, bypassing the UAC prompt.
The <UACMe-executable> is the actual executable file from the UACMe tool.
<path-to-shell-code> is the path where you uploaded your generated Meterpreter shell code.
Outcome: This step will establish a new Meterpreter session with administrative privileges.
After successfully bypassing UAC and obtaining a new Meterpreter session with higher privileges:
Check for Elevated Privileges:
Command:
Explanation:
This command lists the privileges of the current user. If the UAC bypass was successful, you should see administrative privileges in the output.
With administrative privileges, you can perform a variety of post-exploitation tasks:
Upload and Execute Additional Exploits:
Commands:
Potential Actions:
Network Reconnaissance: Scan the network for other vulnerable systems or information.
Access Sensitive Data: Retrieve important files or data from the target system.
Persistence: Set up mechanisms to maintain access, such as creating new user accounts or installing backdoors.
Hacker's Mantra:As economic life relies more and more on the Internet, the potential for small bands of hackers to launch devastating attacks on the world economy is growing.” ― Evgeny Morozov