[gogglebot]

Hello HF!

Please note that this has since been patched in at least Windows 10 by an alteration to eventvwr.exe and other similar signed executables, rendering this script/method dead on up to date Win10, I have no idea about other versions of Windows however. Outdated PCs may still be vulnerable however

I recently found out about a method of bypassing the User Account Control (UAC) prompt (this thing) and decided to implement it into a batch script, thus allowing the script to drop a file/program (be it another .bat, .vbs, or an .exe, etc.) and give it administrator permissions, silently, without telling the user that it is running, and at least in the case of a .bat, runs invisible so there is no cmd prompt window but the batch still runs in the background.
Further the script makes it so your dropped file is run every time the user logs in to their computer, again silently with no window popping up (notice in the video below that no cmd prompt window appears when I log in, it's hidden.)

This could be used as a non-disruptive installer for your piece of software, if you want a file to run hidden at login time, etc.

Click here for a demo video of it in action!

The code used in the demo video, with annotations, is below in this pastebin:

http://pastebin.com/bxt4S1MF


If you would like an in-depth explanation of this script and the mechanisms it uses, ask and I shall update this post (or make a new one later)

[SIM-3489054]

Crazy batch bro thank's for sharing :D

[gogglebot]

Crazy batch bro thank's for sharing :D

Thanks friend ^.^

[WOLGA]

hello,
use 'start /wait' instead of 'timeout'.
-wolga

[b00st3d]

This works. I'm impressed. I have wanted a good UAC bypass method for a while but never really dug into how to do it. I will use this a starting point to make it run a little cleaner for use in scripts that need elevation.

[Cumbax]

Yesterday i read a thread posted yesterday about someone asking for a solution.

Keep it up, this is an amazing piece of code, thanks for sharing!

[ahebah]

Thank's for posting OP, thing's like this come in handy !

[ImDeepWithWindows]

i havent tested it yet cuz im on a mac but it looks good, if it works props 2 this is a HQ worth knowing manipulation

btw on your pastebin i think u have a typo on line 23 that u might wanna fix,
theres only one ">" in your echo command not two ( ">>" ), idk maybe that still works and theres something i dont know that u do, anyway good stuff HQ

[TheTurboEngineers]

Thanks for the Method.
This will come in handy!

[Hoodie+]

i havent tested it yet cuz im on a mac but it looks good, if it works props 2 this is a HQ worth knowing manipulation

btw on your pastebin i think u have a typo on line 23 that u might wanna fix,
theres only one ">" in your echo command not two ( ">>" ), idk maybe that still works and theres something i dont know that u do, anyway good stuff HQ

One writes to the file, two deletes all content and than writes to the file.

[JoshuTee]

Sadly Microsoft has recently patched this, so it will only work on computers that have not been updated yet

[gogglebot]

One writes to the file, two deletes all content and than writes to the file.

Nearly, One overwrites, two amends. In your words: one deletes and writes, two writes

Sadly Microsoft has recently patched this, so it will only work on computers that have not been updated yet

Yeah I found that out earlier today, annoying, took 6 years for them to patch it and they do it just as I make this thing, haha 😭

[Hoodie+]

Isn't this method Windows 10 only?

Is it the same as this: https://enigma0x3.net/2017/03/17/fileles...sdclt-exe/

[b00st3d]

Isn't this method Windows 10 only?

Is it the same as this: https://enigma0x3.net/2017/03/17/fileles...sdclt-exe/

No this works on 7. I have it running on a VM now.

[gogglebot]

Isn't this method Windows 10 only?

Is it the same as this: https://enigma0x3.net/2017/03/17/fileles...sdclt-exe/

7 8 and 10, not sure about vista and probably not XP
The video is of it working on Windows 7 ^.^