# Bypassing UAC

**Introduction**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FcgP0g4PsVkSRIE7JHwSj%2Fimage.png?alt=media&#x26;token=adb75a96-1c01-47d1-b759-2fbf025fc5a5" alt=""><figcaption></figcaption></figure>

**User Account Controls (UAC)**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FesR8Z0z1zUfJmLosIqCi%2Fimage.png?alt=media&#x26;token=3789033a-0557-42a2-a1c8-54359e69c6ee" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FsAY4S6bceB73zLE75JWg%2Fimage.png?alt=media&#x26;token=1e99e8d7-66e4-4cb0-9ae3-6cce0b562c77" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FhWgX08kZtLnLJIa1icPY%2Fimage.png?alt=media&#x26;token=54b1f931-b2ef-4348-ab85-e60858755fb7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FFYiKaeA0yyivRBd9YheX%2Fimage.png?alt=media&#x26;token=735bce4e-75dd-4dee-8ba8-eac06b828db0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FYYDQv4uSK1z8qRL9GNeO%2Fimage.png?alt=media&#x26;token=beaaa01a-a5cb-4777-914e-75b7b8f97ae1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FqXhPlIa6XOLTsHo7iyD2%2Fimage.png?alt=media&#x26;token=c32a6f7b-fc8b-4bc6-8bd5-2b4d1d65ceb4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FbkJprF8zA1V5aiQJpHgh%2Fimage.png?alt=media&#x26;token=98b4b94a-c8f0-41e8-bf1b-33d0429cad91" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FIoNi1a2RRqBzQCS5RZE6%2Fimage.png?alt=media&#x26;token=f5c2eda6-1a9f-4b83-8260-d2f841d67f35" alt=""><figcaption></figcaption></figure>

**UAC: GUI based bypasses**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F6imIgUdtszPda6cYrj4q%2Fimage.png?alt=media&#x26;token=a61db542-284c-4186-98fb-bad6aa8c4f84" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fl5KLUWooj1D5oHopbc09%2Fimage.png?alt=media&#x26;token=eb1d06f4-db76-4dc3-b311-ad0fe9f323e2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F3nR1qaDN8oxaxN54k7Eq%2Fimage.png?alt=media&#x26;token=c4338334-5724-4994-86dd-f8a3f9f5d585" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F1KSy9NuzZSTUDFcjr6WG%2Fimage.png?alt=media&#x26;token=b77a9bfb-454a-4dc4-9483-380963ea5566" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FKiVprdVnSWPGiQ0XDg6n%2Fimage.png?alt=media&#x26;token=dffd522a-9ae4-4f5a-b3dd-e1f8750781de" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FZfZgjO6n1KBymnTMFRll%2Fimage.png?alt=media&#x26;token=6cc52dbd-1016-4c2d-8941-fcd1ac796720" alt=""><figcaption></figcaption></figure>

**UAC: Auto-Elevating Processes**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FcG7WB9TSQ9OM8153WwCu%2Fimage.png?alt=media&#x26;token=5c0145cc-685a-4e85-be11-ed0ee6be32e6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FBjPT7v6GkWhqEh8rDRLV%2Fimage.png?alt=media&#x26;token=82916a57-3eff-49b6-acfb-82d557edc6da" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FSnCmMAtrM256CLRaqdDi%2Fimage.png?alt=media&#x26;token=1fb3f391-bb63-4172-9513-e3cb4a3cfc76" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FPpmjwNQkV8OIR5mLnj0c%2Fimage.png?alt=media&#x26;token=ffc66da4-1d17-4fb8-bf7d-9f79cadf9b85" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fn6pZY8kzHzyOXEzJkO3y%2Fimage.png?alt=media&#x26;token=b85ba521-fbae-4d6c-85bc-2dc48060207b" alt=""><figcaption></figcaption></figure>

**UAC: Improving the Fodhelper Exploit to Bypass Windows Defender**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fa44JjosI14SnvedSEcMb%2Fimage.png?alt=media&#x26;token=86039cf7-9c15-4e34-900b-5ac51dd3745e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fu4Y4NzqKVY2reV9wyiDw%2Fimage.png?alt=media&#x26;token=ea6b15ca-bb16-496d-8793-08982a693e9e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F0yPlbv5qg5rVJnSef9IQ%2Fimage.png?alt=media&#x26;token=ac924cae-0182-46e3-acf7-068c5414ee9a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FnngIL4LgG1VAEVyTkOjm%2Fimage.png?alt=media&#x26;token=6224ec06-44d2-4fff-a242-d9afdd51a07c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FVXZJqx4irKICYEXpwAEX%2Fimage.png?alt=media&#x26;token=88a68435-fcdc-4cd0-9cc1-b73a2fcd0545" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FYRPFko8m15IShkSbxbOW%2Fimage.png?alt=media&#x26;token=6652a38c-e6e5-4d49-b729-5ab40b08e789" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F57FCviwuKCctORKIezWA%2Fimage.png?alt=media&#x26;token=265191fb-1d88-4b42-87cf-0c3df189b546" alt=""><figcaption></figcaption></figure>

**UAC: Environment Variable Expansion**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FyOeO280rFrhOcuLVNupV%2Fimage.png?alt=media&#x26;token=349d7b18-45d5-4d00-8568-a16c1f626b14" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FUwty3y3l2ODcptSlbDfK%2Fimage.png?alt=media&#x26;token=72211b96-1037-4d02-a9f0-44db7c567c78" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FzPc5VRNTbtA1MVWAAcGS%2Fimage.png?alt=media&#x26;token=0353d43a-3c39-4642-8ed9-e9a07cd45f3b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fc0lliR2Qem1Z4yZ7QaXm%2Fimage.png?alt=media&#x26;token=7fdb7380-582d-4070-90f6-248fb5bbcb0d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FY0uKGlndfS0kIQzRepGE%2Fimage.png?alt=media&#x26;token=b3aaa0a7-073e-489b-8da6-47e755066e8b" alt=""><figcaption></figcaption></figure>

**Automated Explotation**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F32ivX7u958ZSzsCFB1Hh%2Fimage.png?alt=media&#x26;token=36369320-8b4c-4f78-badd-f4b9e1c2b2fc" alt=""><figcaption></figcaption></figure>

**Conclusion**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FIE8sZnyCHr4DyYgx6gdZ%2Fimage.png?alt=media&#x26;token=c5c7ffc0-641a-4ead-9da1-e5769a9479de" alt=""><figcaption></figcaption></figure>

* [UACME github repository](https://github.com/hfiref0x/UACME)
* [Bypassing UAC with mock folders and DLL hijacking](https://www.bleepingcomputer.com/news/security/bypassing-windows-10-uac-with-mock-folders-and-dll-hijacking/)
* [UAC bypass techniques detection strategies](https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/)&#x20;
* [Reading your way around UAC](https://www.tiraniddo.dev/2017/05/reading-your-way-around-uac-part-1.html)
