UACME

UACMe Windows ユーザーアカウント制御（UAC）を、組み込みの Windows AutoElevate バックドアを悪用して回避します。このプロジェクトはさまざまな UAC バイパス手法を示し、Windows セキュリティメカニズムを理解するための教育リソースとして機能します。 ⚠️ 警告 : このツールは悪意を持って悪用される可能性のあるセキュリティ脆弱性を示しています。責任を持ち、管理された環境でのみ使用してください。 システム要件 オペレーティングシステム : Windows 7/8/8.1/10/11 x86-32/x64,...

DLLHijackingScanner

UAC绕过 - DLL劫持 描述 这是一个利用DLL劫持和滥用“受信任目录”验证来绕过UAC的概念验证（PoC）。 摘要 从CSV生成头文件 参数 生成易受攻击的PE和DLL列表 DLLHijacking.exe 日志文件 执行 结果 test.dll 来源 从CSV生成头文件 Python脚本CsvToHeader.py可用于生成头文件。默认情况下，它将使用CSV文件dllhijackingcandidates.csv，该文件可在此处找到：dllhijackingcandidates.csv。 脚本会为每个可移植可执行文件（PE）检查以下条件： PE是否存在于文件系统中。...

DLLHijackHunter

DLLHijackHunter 由 GhostVector Academy 提供 自动化 DLL 劫持发现、验证与确认 将本地配置缺陷转化为可武器化、经确认的攻击路径。 概述 DLLHijackHunter 是一款自动化 Windows DLL 劫持检测工具，超越了静态分析。它通过多阶段流水线发现、验证并确认 DLL 劫持机会： 1. 发现 — 枚举服务、计划任务、启动项、COM 对象以及 AutoElevate UAC 绕过向量中的二进制文件 2. 过滤 — 通过智能硬门槛和软门槛消除误报 3. Canary 确认 — 部署无害的 canary DLL 并触发二进制文件来证明劫持可行 ...

DLLHijackingScanner - This Is A PoC For Bypassing UAC Using DLL Hijacking And Abusing The "Trusted Directories" Verification

This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification. Generate Header from CSV The python script CsvToHeader.py can be used to generate a header file. By default it will use the CSV file dllhijackingcandidates.csv that can be found here:...

Microsoft Windows - Multiple UAC Protection Bypass Exploit

Windows 10 UAC bypass for all executable files which are autoelevate true. https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47753.zip...

Microsoft Windows - Multiple UAC Protection Bypasses

Windows 10 UAC bypass for all executable files which are autoelevate true. https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html Download https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47753.zip...

Microsoft Windows - Multiple UAC Protection Bypasses

Microsoft Windows - Multiple UAC Protection Bypasses Windows 10 UAC bypass for all executable files which are autoelevate true. https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html Download...

Microsoft Windows 10 - UAC Protection Bypass Via Microsoft Windows Store (WSReset.exe) and Registry (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows 10 UAC Protection Bypass Via Windows Store WSReset.exe and Registry', 'Description' = %q This module exploits a flaw in the WSReset.exe...

Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe)

This module exploits a flaw in the WSReset.exe Windows Store Reset Tool. The tool is run with the "autoElevate" property set to true, however it can be moved to a new Windows directory containing a space C:\Windows \System32\ where, upon execution, it will load our payload dll propsys.dll. Module...

UACME - Defeating Windows User Account Control

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. System Requirements x86-32/x64 Windows 7/8/8.1/10 client, some methods however works on server version too. Admin account with UAC set on default settings required. Usage Run executable from command line:...

Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe) and Registry

This module exploits a flaw in the WSReset.exe file associated with the Windows Store. This binary has autoelevate privs, and it will run a binary file contained in a low-privilege registry location. By placing a link to the binary in the registry location, WSReset.exe will launch the binary as a...