How to invoke UAC(Elevation shield) Prompt while trying to open bootstrapper bundle exe in WIX

[sarojnayak1991]

Not able to invoke UAC shield of the bootstrapper bundle .exe generated using WIX.UAC gets invoked when Install button is clicked from bundle exe UI.But I need to open UAC as soon as user double clicks the bundle .exe.

I tried WixBundleElevated in wix bundle wxs file in bal:Condition.This works fine.When user double click the exe bundle,error throws up like "you need admin priviledges".Instead of throwing error,I want to invoke UAC shield as soon as user double click the bundle exe.

[robmen]

Call the IBoostrapperEngine.Elevate() method at the beginning of your custom bootstrapper application. That will prompt the user for UAC before your application does anything.

Note: Some websites out there talk about hacking the Burn stub to modify the resources that force the executable to always elevate. Don't do that. That isn't a supported configuration and could leave you open to security vulnerabilities that we don't consider. I bring this up because we've had a series of security vulnerabilities recently. 😓

[sarojnayak1991]

Hi @robmen. We are not using custom bootstrapper application.Instead using WixStandardBootstrapperApplication.Is there any way to achieve this in Bundle.wxs without custom bootstrapper.

[sarojnayak1991]

@robmen We are using wix 4.0.3.there is one security bug reported GHSA-7wh2-wxc7-9ph5, which tells user temp folder is used when wix bundle is run without admin privileges and it has been reported that after migrating to wix 4.0.4 or 4.0.5 this issue will disappear. But after migrating to wix 4.0.4 or even 4.0.5 I could observe that if the bundle exe is run without admin privileges.The .be folder which the burn engine creates in user temp folder is not protected by ACL. The standard user has access to the folder. So we thought of elevating the bundle itself or Is there anything we can do the apply the ACL(SYSTEM and Administrator) to the user temp guid folders which wix bundle creates.

[robmen]

Try it. If you find an attack vector, please report it properly using the GitHub Security Advisory.

Reporting security vulnerabilities in public puts more people at risk than necessary.

[sarojnayak1991]

Hi @robmen. We are not using custom bootstrapper application.Instead using WixStandardBootstrapperApplication.Is there any way to achieve UAC invoking in Bundle.wxs without custom bootstrapper.

[chrpai]

@robmen have you considered doing some form of reflection and failing the installer when this hacking is detected?

[robmen]

No, because the WiX Toolset is open source. Anyone can modify the code. Of course, modifying files requires understanding what you are doing and accepting the new security situation those modifications require.

That last bit is the really hard part. The WiX project benefits because we (FireGiant) have customers, and the project (in general) has many consumers with a wide range of security exposures. That helps flush out security issues.... as we've learned this last quarter. 😩

[chancezheng]

you can modify pe file by CFF Explorer, you can watch my blog https://www.cnblogs.com/chancezheng/p/18325719, next, you can achieve it by C# code