[SRC / VID] UAC Bypass Win 8.1

The source code modifications to POC (GUI version without the direct use of the code, we can implement your own, there is not released) foreigners initially reported
This document contains a detailed description of the POC:
Initially released foreigner win7 UAC bypass URL is as follows:
hxxp://www.pretentiousname.com/misc/win7_uac_whitelist2.html

win8.1 Dll hijack that has been repaired, we now come to hijack another exe, windows exe can be hijacked several ...

BypassUac_Inject.cpp source code is more crucial to a file, in addition to some other file interprocess memory copy code is GUI-related code.

The POC program includes:

- GUI code (most of the code are UI-related code, you can write a command-line version)

- Error handling / reporting code (easy after the program error diagnostics)

- Cleanup code (after bypass UAC, clean up legacy in the system directory Dll)

- We can choose a different target process to inject (a process Explorer.exe is more appropriate, in addition Calc.exe, Notepad.exe, MSPaint.exe also can)

In fact, the code is not that complicated, really.

* Note *

- For 64-bit operating system compiled into 64 programs for 32-bit operating system compiled into 32 programs ...

- If you do not accidentally injected DLL 32 to 64 in the process went, into the process of the program may be Ben collapse, and vice versa ... so 32 pairs 32 operating system, 64 pairs of 64-bit operating system .. .

- You choose the target process may need to open ASLR (address randomization), if you turn off the EXE ASLR, then the target process will also require close ASLR. Essentially, Kernel32.dll loading process to address both the same, so the two processes handle on the address randomization consistently. System processes that can be used basically opened the ASLR, so the compiler option default. If you inject found during the collapse of the target process, and this time you can check the state of the process of Explorer ASLR.

- The code multi-process / multi-thread is unsafe (because black DLL may also be used, so you may need to add a mutex to prevent spurious DLL is detected deleted)

** Details use: **

The code use two vulnerabilities of the system. The first flaw comparative vulnerability, but also more difficult to repair. The second vulnerability DLL hijacking relatively easy to fix, it does not, win8.1 Mikocok will fix the dll that classic sysprep.exe hijacking.

Exploit 1 (general permission to copy files to the system directory without triggering pop interception):

1.1) we choose a Mikocok digital signature program, such as: Explorer.exe.
1.2) target remote thread injection process. (There is no god horse restrictions? We just need to choose the process with our main program in the same (Session) session, Explorer.exe is a good target process.)
1.3) was injected code to create a COM object IFileOperation. (If it is win7,8,8.1 default UAC option, and the target process is to have Mikocok copyright and digital signature program, it will not trigger the UAC prompt.)
1.4) was injected code IFileOperation interface using our black Dll files copied to the specified system
1.5) was injected code will start with a shield and is UAC whitelist program
1.6) was injected code with shields and is waiting to start UAC whitelist program is completed.
1.7) was injected code using IFileOperation interface delete black Dll.

Exploit 2 (System Dll hijacking):

BypassUacDll.dll is a very simple dynamic link library files, in the form of resource files to the main program BypassUac embedded inside.

We are looking for can Dll hijack the system program.

Note: We move / rename / replace the file under System32. You will find that if you were an ordinary privileges move / rename / replace, etc., it will pop prompt with administrator privileges to operate. So we need IFileOperation object mentioned above to help us to complete these operations.

How to find it can Dll hijack procedures, monitoring System32 process, you will find C: \ Windows \ sysprep.exe will System32 \ sysprep directory called cryptbase.dll default load a dynamic link library.

And this cryptbase.dll is located in the System32 directory below, currently there is no good way to replace it, but we can take advantage of a loophole to replicate a fake Dll to go sysprep directory, sysprep.exe default will load in the current directory cryptbase.dll, if you can not find it, only to find the System32 directory cryptbase.dll.

By injecting win8.1 sysprep.exe hijacking has expired, we use another program to C: \ Windows \ System32 \ migwiz \ migwiz.exe


Download