UAC Bypass
MITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001
Last updated
Was this helpful?
MITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001
Last updated
Was this helpful?
The User Account Control . Its a Windows security feature that forces any new process to run in the security context of a non-privileged account by default..
UAC is a Mandatory Integrity Control (MIC), which is a mechanism that allows differentiating users, processes and resources by assigning an Integrity Level (IL) to each of them. In general terms, users or processes with a higher IL access token will be able to access resources with lower or equal ILs. MIC takes precedence over regular Windows DACLs The following 4 ILs are used by Windows, ordered from lowest to highest:
Low
Very limited permissions
Medium
users and Administrators' filtered tokens.
High
Administrators' elevated tokens if UAC is enabled.
System
Reserved for system use.
some executables can auto-elevate, achieving high IL without any user intervention. This applies to most of the Control Panel's functionality and some executables provided with Windows. For an application, some requirements need to be met to auto-elevate: - The executable must be signed by the Windows Publisher - The executable must be contained in a trusted directory, like %SystemRoot%/System32/ or %ProgramFiles%/ - Executable files (.exe) must declare the autoElevate element inside their manifests. To check a file's manifest, we can use sigcheck.
Indeed we can leverage this executables to bypass UAC. Let's dive in:
if UAC is configured on the "Always Notify" level, fodhelper and similar apps won't be of any use as they will require the user to go through the UAC prompt to elevate.
Microsoft doesn't consider UAC a security boundary but rather a simple convenience to the administrator to avoid unnecessarily running processes with administrative privileges. In that sense any bypass technique is not considered a vulnerability to Microsoft, and therefore some of them remain unpatched to this day.
We will create an entry on the registry for a new progID of our choice (any name will do) and then point the CurVer entry in the ms-settings progID to our newly created progID. This way, when fodhelper tries opening a file using the ms-settings progID, it will notice the CurVer entry pointing to our new progID and check it to see what command to use.
Detected by Windowds Defender
Note that we removed the .exe extension in an attempt to evade Windows Defender (e.g. using nc64 instead of nc64.exe). By omitting the extension, Windows will still execute the binary.
We may clean-up as follows
SilentCleanup launches cleanmgr.exe using the %windir% environment variable. By modifying %windir%, we can control what gets executed.
We can abuse it as follows
We may clean-up as follows
33
fodhelper.exe
34
DiskCleanup scheduled task
70
fodhelper.exe using CurVer registry key
The exploit code is proposed by
Originally discovered by from , the "DiskCleanup Bypass" take advantage of the SilentCleanup scheduled task, which is configured on Windows by default.This tasks can be started from a process with a medium integrity level, and then automatically elevates to a high integrity level since the "Run with highest privileges" option is enabled.
While provides several tools, we will focus mainly on the one called Akagi, which runs the actual UAC bypasses If you want to test for method 33, you can do the following from a command prompt, and a high integrity cmd.exe will pop up:
