[Kroshie]

Hello! I've spent the last several weeks learning about process injection, in-memory execution, cryptography, syscalls, user-land hooks etc. and have managed to get myself to a point where I'm able to achieve execution of my tools on your standard home installation of Windows 10 and 11. To be honest, there is still a lot of trial and error and frankensteined code patched together from a variety of opensource projects but I wanted to change things up for a bit and shift my focus over to privilege escalation.

Having been dealing with mostly vanilla installations of Windows 10 and 11 means I'm running into the UAC wall. I've managed to pull off some social-engineering based tricks that will on occasion give me an elevated process, but I'd like to find a more consistent method of obtaining privileged execution. Initial forays into the topic lead me to believe I missed out on a real heyday...AKA fodhelper, but I'm having trouble finding a modern technique that I might be able to borrow from.

The UACME project has been a great resource, but my coding knowledge has proved to be a bit of a speed bump. A lot of the POC's available from UACME on github pop an elevated shell quite easily, but I've been trying to edit the code to instead launch one of my own executables rather than cmd.exe and I've come to learn I simply don't have enough of an understanding of the trade-craft to make that happen yet. I've also had a brief look at abusing mock directories and proxied DLL's, but I wasn't successful on my initial attempts and I'm left wondering if I'm approaching the problem from the right angle.

I can get an unprivileged shell or Meterpreter consistently and I'm looking for suggestions from you guys as to what UAC bypass theory or techniques would be a good place to start investing my time into learning?

[Biggy_Asian]

Hello! I've spent the last several weeks learning about process injection, in-memory execution, cryptography, syscalls, user-land hooks etc. and have managed to get myself to a point where I'm able to achieve execution of my tools on your standard home installation of Windows 10 and 11. To be honest, there is still a lot of trial and error and frankensteined code patched together from a variety of opensource projects but I wanted to change things up for a bit and shift my focus over to privilege escalation.

Having been dealing with mostly vanilla installations of Windows 10 and 11 means I'm running into the UAC wall. I've managed to pull off some social-engineering based tricks that will on occasion give me an elevated process, but I'd like to find a more consistent method of obtaining privileged execution. Initial forays into the topic lead me to believe I missed out on a real heyday...AKA fodhelper, but I'm having trouble finding a modern technique that I might be able to borrow from.

The UACME project has been a great resource, but my coding knowledge has proved to be a bit of a speed bump. A lot of the POC's available from UACME on github pop an elevated shell quite easily, but I've been trying to edit the code to instead launch one of my own executables rather than cmd.exe and I've come to learn I simply don't have enough of an understanding of the trade-craft to make that happen yet. I've also had a brief look at abusing mock directories and proxied DLL's, but I wasn't successful on my initial attempts and I'm left wondering if I'm approaching the problem from the right angle.

I can get an unprivileged shell or Meterpreter consistently and I'm looking for suggestions from you guys as to what UAC bypass theory or techniques would be a good place to start investing my time into learning?

1) Theyre not easy to make
2) Mockdir is a shit uac bypass and is super easy to detected and remove
3) Your not gonna learn much if you just read from the code.
4) By the sounds of it you just copy paste code and do a little rewriting am I wrong? RE below quote

Because of this I truely believe you dont exactly understand computers or anything much when it comes to the realm of hacking and/or exploiting vulns

To be honest, there is still a lot of trial and error and frankensteined code patched together from a variety of opensource projects

I have a UAC bypass which runs a shell with an elevated token. It is not hard to do if you have an understanding. Reading POC's and other open source material wont help you especially without an indepth explanation.

Please go actually learn and read up on things instead of copy pasting code from github. Also learn how heavily x is sigged before attempting to exploit. You could attempt to abuse SSPI but because it is heavily sigged it is almost no use.

ALMOST if not all UAC bypasses on github are either:
- Outdated
- Do work but are abusing heavily sigged methods
- Do work but are detected/dont work on x version of windows (10/11 e.g)

[Kroshie]

1) Theyre not easy to make
2) Mockdir is a shit uac bypass and is super easy to detected and remove
3) Your not gonna learn much if you just read from the code.
4) By the sounds of it you just copy paste code and do a little rewriting am I wrong? RE below quote

Because of this I truely believe you dont exactly understand computers or anything much when it comes to the realm of hacking and/or exploiting vulns

I have a UAC bypass which runs a shell with an elevated token. It is not hard to do if you have an understanding. Reading POC's and other open source material wont help you especially without an indepth explanation.

Please go actually learn and read up on things instead of copy pasting code from github. Also learn how heavily x is sigged before attempting to exploit. You could attempt to abuse SSPI but because it is heavily sigged it is almost no use.

ALMOST if not all UAC bypasses on github are either:
- Outdated
- Do work but are abusing heavily sigged methods
- Do work but are detected/dont work on x version of windows (10/11 e.g)

🤦‍♂️Dude, you must have a lot of time on your hands to spend it accusing me of doing things I openly admitted to. I'm not sure if you’re trying to impress someone here or missed the part where I clearly said I’m using code from open-source projects as a learning tool. You also seem to think pointing out that UAC bypasses are tricky somehow contradicts the entire premise of my post: that I'm looking to learn because I acknowledge the difficulty. But thank you for making it clear that I need to continue my education. And by all means, continue patting yourself on the back for pointing out how little I know—it’s almost like that was the entire purpose of my post.

Anyways, your attempt at superiority has been noted and dismissed. Moving on.

[Null State]

🤦‍♂️Dude, you must have a lot of time on your hands to spend it accusing me of doing things I openly admitted to. I'm not sure if you’re trying to impress someone here or missed the part where I clearly said I’m using code from open-source projects as a learning tool. You also seem to think pointing out that UAC bypasses are tricky somehow contradicts the entire premise of my post: that I'm looking to learn because I acknowledge the difficulty. But thank you for making it clear that I need to continue my education. And by all means, continue patting yourself on the back for pointing out how little I know—it’s almost like that was the entire purpose of my post.

Anyways, your attempt at superiority has been noted and dismissed. Moving on.

Realistically, you should learn a programming language, windows internals, and as a bonus Assembly. It'll make RE much easier for you, and will also help you understand a lot more about what is actually going on in the background.

I don't mean this for UAC specifically, but in general if you're wanting to get into binary exploitation it's gonna come to a point where it's needed. As the other user stated also, most stuff on GitHub isn't gonna be as simple as copy code over and it works.

I would say learn C and/or C++, and as for windows internals here: https://www.microsoftpressstore.com/stor...0735684188 as well as https://www.microsoftpressstore.com/stor...0135462409

Windows 11 isn't covered in those I don't think, but is still very relevant.

Also, if you need help finding those PM me.

[Kroshie]

Realistically, you should learn a programming language, windows internals, and as a bonus Assembly. It'll make RE much easier for you, and will also help you understand a lot more about what is actually going on in the background.

I don't mean this for UAC specifically, but in general if you're wanting to get into binary exploitation it's gonna come to a point where it's needed. As the other user stated also, most stuff on GitHub isn't gonna be as simple as copy code over and it works.

I would say learn C and/or C++, and as for windows internals here:

Windows 11 isn't covered in those I don't think, but is still very relevant.

Also, if you need help finding those PM me.

Here are some suggestions I can get on-board with, I appreciate your willingness to gently point me in the right direction. Sometimes it's hard to choose where to break ground and get started because it all looks like such good ground to break, you know?

Also, if you need help finding those PM me.

Wait a sec...was this all just a ploy to offload some old books you've got lying around!? Unbelievable...

All jokes aside though, thanks for your suggestions!

[Null State]

Here are some suggestions I can get on-board with, I appreciate your willingness to gently point me in the right direction. Sometimes it's hard to choose where to break ground and get started because it all looks like such good ground to break, you know?


Wait a sec...was this all just a ploy to offload some old books you've got lying around!? Unbelievable...

All jokes aside though, thanks for your suggestions!

I like helping out where I can, and books is something I can almost always help with lol.

[Biggy_Asian]

🤦‍♂️Dude, you must have a lot of time on your hands to spend it accusing me of doing things I openly admitted to. I'm not sure if you’re trying to impress someone here or missed the part where I clearly said I’m using code from open-source projects as a learning tool. You also seem to think pointing out that UAC bypasses are tricky somehow contradicts the entire premise of my post: that I'm looking to learn because I acknowledge the difficulty. But thank you for making it clear that I need to continue my education. And by all means, continue patting yourself on the back for pointing out how little I know—it’s almost like that was the entire purpose of my post.

Anyways, your attempt at superiority has been noted and dismissed. Moving on.

If you cannot take criticism don't ask and grow up a little. Also UAC bypasses >> CAN << be difficult to find if your goal is to have as small of a signature as possible.

If you read below my little list you would've seen some additional information that may help you.

Please dont get mad if you cant take any kind of some what critical feedback also I was asking if I was wrong for assuming you just copy paste code. If you had given an actual good answer without the slight attitude I may have been able to give a little more help ;)

I am not here to impress anyone. We are all here for our own reasons. I will not benefit much from trying to impress a single person either. Grow up dude.

[JonteAka]

1) Theyre not easy to make
2) Mockdir is a shit uac bypass and is super easy to detected and remove
3) Your not gonna learn much if you just read from the code.
4) By the sounds of it you just copy paste code and do a little rewriting am I wrong? RE below quote

Because of this I truely believe you dont exactly understand computers or anything much when it comes to the realm of hacking and/or exploiting vulns

I have a UAC bypass which runs a shell with an elevated token. It is not hard to do if you have an understanding. Reading POC's and other open source material wont help you especially without an indepth explanation.

Please go actually learn and read up on things instead of copy pasting code from github. Also learn how heavily x is sigged before attempting to exploit. You could attempt to abuse SSPI but because it is heavily sigged it is almost no use.

ALMOST if not all UAC bypasses on github are either:
- Outdated
- Do work but are abusing heavily sigged methods
- Do work but are detected/dont work on x version of windows (10/11 e.g)

@Biggy hit me up, I cant PM low posts.
need ur uac bypass

[Biggy_Asian]

@Biggy hit me up, I cant PM low posts.
need ur uac bypass

Not for sale.