Jan 4
Bypassing Windows User Account Control
*Note: This article was originally published by the author on December 25, 2018.
“The greatest victory is that which requires no battle.”― Sun Tzu, The Art of War
**DISCLAIMER** Before we get too deep into this, as an ethical hacker I am compelled to warn those reading that this information is solely intended to be used in conjunction with sanctioned Red Team activities as part of a contracted service with the permission of the target. When conducting pentesting, always protect yourself with a proper contract that is signed by the target organization allowing you permission to “hack” their organization for pentesting/vulnerability assessment that contains the scope of the operation. Exercise due caution accordingly. Consider yourself warned! Any other use could be illegal.
Look at you go with your badass hacker self, just hackity-hack-hackin’ away. As the quote from Sun Tzu’s Art of War suggests, however, if you can defeat your opponent without a fight or little-to-no effort then that indeed is a great accomplishment and is preferred to having to exhaust your precious resources.
As a hacker, you should pride yourself in unconventional thinking and being able to solve challenges such as achieving system access via the easiest and most direct route. There are times for taking the longer, harder road, such as when attempting to avoid intrusion detection. Other times, it is entirely about the speed of action and getting in and out as quickly as possible or the ‘smash and grab’ type of operations as they are colloquially known.
It comes down to knowing your target and operating environment and how hackers come to this information is through reconnaissance and enumeration. At this point in the process, you’ve likely already conducted your Open Source Intelligence (OSINT) reconnaissance of the target; you’ve performed some enumeration on the target; and you’ve conducted external, host, and internal reconnaissance along with custom-tailored social engineering attacks against your target.
Throughout all of these steps, hopefully somewhere along the way, your hard work paid off in some measure. Perhaps you were even able to pop a shell and gain access to the target system(s). Or, perhaps you were only able to compromise the credentials of a basic user account though. If that was the case, then what can you do to get around not having local admin rights due to User Account Control on a Windows system? Enter the niche realm of UAC bypass privilege escalation techniques.
User Account Control is a Windows OS security feature that enables a normal user to perform limited administrator functions if they’ve been granted the authority to do so and serves a secondary, albeit equally important purpose, of preventing normal users from performing specific actions that could pose a security risk to the system by requiring users to have administrator-level permissions to perform specific functions. Microsoft created UAC as an additional security control feature designed to limit the propagation of malware and keep users from wreaking havoc in the system. Need to install a program, but Windows won’t allow you because you’re not an administrator? Welcome to User Account Control (UAC). Depending on whether administrators have enabled UAC and how it is configured, applications that require an administrator access token must prompt the user for consent by an Admin account.
Of course, for security reasons enabling UAC to detect application installations and prompt for elevation to prevent regular user accounts from installing unauthorized software on clients is a best practice within Windows OS environments. A complete lesson on how UAC works is beyond the scope of this chapter other than to provide the UAC architecture diagram (below) and to tell you that UAC is an access token-based system where administrator accounts (Security Identifier or SID-500 which end in 500 denotes the admin account; 501 denotes the guest account, etc.) have full-access tokens issued upon successful login and standard users do not.
Several unique Windows UAC bypasses have been published. Depending on how UAC is enabled on the target system, you may still work. There’s also the possibility that some UAC bypasses have not been discovered yet (like Easter eggs) and there are probably others that are being held onto by attackers or organizations to be used at a later time strategically for nation-state computer network espionage (CNE), computer network attack (CNA), or cybercrime exploits.
The following meager list of UAC bypasses is by no means meant to be an exhaustive list, but rather just a few of them to whet your appetite. Further research on this topic is in your best interest if you’re going to be a successful Red Teamer and you might encounter a Windows OS in which UAC is not enabled to protect against these vulnerabilities or where the primary user is a local admin account by default. Some UAC bypasses are very simple to perform, others not so much. Tailor expectations to your skill and knowledge level. The bypasses I’ve listed here are fairly easy. Achieving local admin in a Windows OS environment has become quite trivial thanks to Microsoft continually writing insecure code that is often left wide open for exploitation for common user functionality purposes.
For a UAC bypass to be successful the following components need to be met:
An intermediate-level integrity process.
Login credentials acquired for a standard user account belonging to an administrators group on the system.
The Windows executable must be signed by Microsoft code signing certificate.
Windows executable must be located in a secure directory.
Windows executable also must specify the auto-elevate property in their manifest.
Windows UAC Bypasses
Bypassing UAC is similar to picking a lock to achieve privilege escalation.
1. This particular Windows UAC bypass is courtesy of Dhiraj Mishra is super easy to execute (it can be done in less than 30 seconds).
- In the Windows Run prompt type: netplwiz.exe;
- Select the “Advanced” tab;
- Select the “Advanced” option on the Advanced user management section;
- The Local Users and Groups (Local) box will open; Select “Help Topics;”
- Right-click and select “View Source;”
- Select “File,” “Open;”
- Navigate to “Computer>>Local Disk (C:)>>Windows>>System32;”
- Change selection to “All Files;”
- Find and select “Cmd.exe;”
- Right-click “Cmd.exe” and select “Run as administrator.” Voila! Prestidigitation. An administrator Cmd Prompt appears.
I verified that this particular UAC bypass still works on the latest Windows 10 build as the date of this publication, but as some have noted it will not work depending on how UAC is enabled on the system as long as “always notify” was not set by the administrator.
2. Fileless UAC bypass.
German Masters student Christian B. is credited with discovering the “fodhelper.exe” UAC bypass. The “fodhelper.exe” program allows users to manage optional features within the Windows Settings “Apps & Features” screen. The bypass, which is similar to a previously published “eventvwr.exe” bypass, abuses the trust relationship of auto-elevation assigned to trusted binaries that Microsoft assigns to trusted folders such as C:\Windows\System32. Since “fodhelper.exe” is a trusted binary, Windows doesn’t prompt for administrator approval.
C:\Windows\System32\fodhelper.exe
The “fodhelper.exe” binary links to two unique registry keys, one of which is editable and can be weaponized to use in combination with malware capable of running scripts in the background in elevated administrator access.
Editable Registry Key associated with “fodhelper.exe” binary
This UAC bypass executes in memory, so there’s no file dropping or DLL hijacking involved. For this bypass to work correctly, however, the user account must be part of the local administrator group. I demonstrate how a standard user account can be elevated to the local administrator group in chapter 14, “Network Domination & Persistence.” However, most users commonly use local admin-level accounts as their default account to perform everyday tasks on their home PCs. Therefore, this UAC bypass remains a credible vulnerability. For security administrators, setting UAC to “Always notify” will protect against this bypass as well.
3. It’s also possible to bypass UAC in Windows 7/8/10 & Server 2K8, 2K12, 2K16 by hijacking the COM object: {0A29FF9E-7F9C-4437–8B11-F424491E3931} Target apps: eventvwr.exe or mmc.exe.
- This bypass is a bit more advanced and requires advanced knowledge of the Kali Linux OS and the Metasploit Framework (MSF) tool. Watch the YouTube video for step-by-step instructions or read Enigma0x3’s (Matt Nelson) “CVE-2018–8414: A case study in responsible disclosure.”
It is also important to note that the MITRE ATT&CK organization has an entire webpage dedicated to how Windows UAC bypasses have been used in various malware samples by cybercriminals and nation-state Advanced Persistent Threats (APT) groups. Here are a few examples:
- APT 29 (a.k.a., Cozy Bear, CozyDuke, The Dukes)
- BlackEnergy
- FinFisher
- H1N1
- InvisiMole
- Pupy
- Shamoon
- APT 27 (a.k.a., Iron Tiger, LuckyMouse, Emissary Panda, TG-3390)
Summary
Microsoft has repeatedly downplayed UAC bypasses as not qualifying as a security boundary. However, the fact remains that many systems run everything at the local admin permission level or equivalent which we all know is wrong and risky but sometimes it is necessary for certain functions. It makes UAC bypasses very effective for Red Teamers. Experienced system and security administrators should NEVER trust UAC, should not run as split-token admin, and ALWAYS use a non-admin user account for your non-admin tasks. Use the right-click, “Run As” option or log off and log back in as an admin.
Additional resources for further exploration:
Peerlyst Wiki: UAC Bypasses and UAC bypass research
@enigma0x3’s research (and his DerbyCon talk: slides, video)
@tiraniddo’s bypass techniques on UAC via the SilentCleanup task and process token reading: part 1, part 2 & part 3
@hFireF0X’s UACME project that implements most known UAC bypasses, and his posts on kernelmode
@FuzzySec’s UAC workshop, and his Bypass-UAC project that implements several bypasses in PowerShell
