Hack Forums
UAC bypass, bypasses windows defender (and more) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: UAC bypass, bypasses windows defender (and more) (/showthread.php?tid=6250430)

UAC bypass, bypasses windows defender (and more) - moom825 - Aug 29, 2023

Heya all,

I came across this interesting UAC bypass on Twitter. It abuses EventViewer's unsafe deserialization of its RecentViews file (which is publicly accessible). I recreated the entire thing in C# and made improvements. Now, it creates no visible window, is completely automated, and doesn't rely on any external libraries.

After recreating the entire thing, I realized that it was being detected by Windows Defender, not the UAC bypass itself, but the modified RecentViews file. I made some modifications by patching the file before it's written. As of writing this thread, it now successfully bypasses Windows Defender.

I hope you all enjoy it! Feel free to donate by quick hearting. But for those of you who are a bit stingy, here's the link to the GitHub repository: EventViewer-Unsafe-Deserialization-UACBypass


Enjoy! ✌


[Image: ezgif-3-8baf26d5cf.gif]

RE: UAC bypass, bypasses windows defender (and more) - Skel3r - Aug 29, 2023

Nice work.

You should embed GIF on Github page too :)

RE: UAC bypass, bypasses windows defender (and more) - moom825 - Aug 29, 2023

(Aug 29, 2023 12:11 PM)m0hx Wrote:  nice share, i'll give it a try on win11.

seems like its only for 10, it creates the even but didn't do the uac nor anything just exists.
Spoiler (Click to View)

pretty sure can be modified to work.

https://kleenscan.com/scan_result/1844e5daa10a7a59b2560e5528328ab3e864d6123ef28b1b8e23c68d1e4a308f

they did a bunch of updates for windows 11, they could have changed the desearilization method for the recentviews, ill take a look at it when i get home, thx for the heads up

RE: UAC bypass, bypasses windows defender (and more) - osn64698 - Aug 30, 2023

There is no need to try new methods when old ones work perfectly on all OS's with 0 av detection.
https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html

RE: UAC bypass, bypasses windows defender (and more) - moom825 - Aug 30, 2023

(Aug 30, 2023 06:25 AM)osn64698 Wrote:  There is no need to try new methods when old ones work perfectly on all OS's with 0 av detection.
https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html

just tested it, doesn't seem to work on latest version of windows

RE: UAC bypass, bypasses windows defender (and more) - DramaKing - Aug 30, 2023

(Aug 30, 2023 06:25 AM)osn64698 Wrote:  There is no need to try new methods when old ones work perfectly on all OS's with 0 av detection.
https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html

The vendor that you linked to is clearly able to detect it.

RE: UAC bypass, bypasses windows defender (and more) - osn64698 - Aug 30, 2023

(Aug 30, 2023 07:01 PM)DramaKing Wrote:  The vendor that you linked to is clearly able to detect it.

Nobody detects it, I am saying it from experience. Defender/ Kaspersky/ Bit-Defender/ Avira/ Avast /AVG / Trend Micro etc. I also tested all EDRs.
You don't have to use CoGetObject, people who get detected simply copy and paste the same code, so that is obviously their issue, they should use their 1% brain.
I won't spoon feed HF people since tomorrow you will have 10 new Crypt3rs with UAC Bypass.

RE: UAC bypass, bypasses windows defender (and more) - MMKS - Aug 31, 2023

hello darmaking I need service for fb hack care to help ?

RE: UAC bypass, bypasses windows defender (and more) - DramaKing - Aug 31, 2023

(Aug 31, 2023 05:49 AM)MMKS Wrote:  hello darmaking I need service for fb hack care to help ?

Misspelling my username, going off-topic, and asking for service in the wrong forum

Anyway, here's a "fb hack:" https://grahamcluley.com/hack-facebook-sms/. You can also transfer an associated phone number to your phone.

RE: UAC bypass, bypasses windows defender (and more) - MMKS - Aug 31, 2023

I'm truly sorry for my mistakes... Im in a rush to take down the scammers, can you elaborate how can I use this tool sir ?

RE: UAC bypass, bypasses windows defender (and more) - DramaKing - Aug 31, 2023

(Aug 31, 2023 06:32 AM)MMKS Wrote:  I'm truly sorry for my mistakes... Im in a rush to take down the scammers, can you elaborate how can I use this tool sir ?

Did you read the article?