[moom825]

Heya all,

I came across this interesting UAC bypass on Twitter. It abuses EventViewer's unsafe deserialization of its RecentViews file (which is publicly accessible). I recreated the entire thing in C# and made improvements. Now, it creates no visible window, is completely automated, and doesn't rely on any external libraries.

After recreating the entire thing, I realized that it was being detected by Windows Defender, not the UAC bypass itself, but the modified RecentViews file. I made some modifications by patching the file before it's written. As of writing this thread, it now successfully bypasses Windows Defender.

I hope you all enjoy it! Feel free to donate by quick hearting. But for those of you who are a bit stingy, here's the link to the GitHub repository: EventViewer-Unsafe-Deserialization-UACBypass


Enjoy! ✌

[Skel3r]

Nice work.

You should embed GIF on Github page too :)

[moom825]

nice share, i'll give it a try on win11.

---

seems like its only for 10, it creates the even but didn't do the uac nor anything just exists.
Spoiler (Click to View)

pretty sure can be modified to work.

https://kleenscan.com/scan_result/1844e5...8d1e4a308f

they did a bunch of updates for windows 11, they could have changed the desearilization method for the recentviews, ill take a look at it when i get home, thx for the heads up

[osn64698]

There is no need to try new methods when old ones work perfectly on all OS's with 0 av detection.
https://www.elastic.co/guide/en/security...rface.html

[moom825]

There is no need to try new methods when old ones work perfectly on all OS's with 0 av detection.
https://www.elastic.co/guide/en/security...rface.html

just tested it, doesn't seem to work on latest version of windows

[DramaKing]

There is no need to try new methods when old ones work perfectly on all OS's with 0 av detection.
https://www.elastic.co/guide/en/security...rface.html

The vendor that you linked to is clearly able to detect it.

[osn64698]

The vendor that you linked to is clearly able to detect it.

Nobody detects it, I am saying it from experience. Defender/ Kaspersky/ Bit-Defender/ Avira/ Avast /AVG / Trend Micro etc. I also tested all EDRs.
You don't have to use CoGetObject, people who get detected simply copy and paste the same code, so that is obviously their issue, they should use their 1% brain.
I won't spoon feed HF people since tomorrow you will have 10 new Crypt3rs with UAC Bypass.

[MMKS]

hello darmaking I need service for fb hack care to help ?

[DramaKing]

hello darmaking I need service for fb hack care to help ?

Misspelling my username, going off-topic, and asking for service in the wrong forum

Anyway, here's a "fb hack:" https://grahamcluley.com/hack-facebook-sms/. You can also transfer an associated phone number to your phone.

[MMKS]

I'm truly sorry for my mistakes... Im in a rush to take down the scammers, can you elaborate how can I use this tool sir ?

[DramaKing]

I'm truly sorry for my mistakes... Im in a rush to take down the scammers, can you elaborate how can I use this tool sir ?

Did you read the article?