UAC Bypass via IDiagnosticProfile COM Interface

[Ruuucker]

Hi, I come across this: https://github.com/Wh04m1001/IDiagnosticProfileUAC
Seems like a new method to move arbitrary file as Administrator via SaveDirectoryAsCab method of IDiagnosticProfile. Which is interesting bc majority of UAC bypasses uses IFileOperation\ISecurityEditor.
The second part is also new, it uses wow64log.dll and Edge. Take a look.

[hfiref0x]

Hello,

what is the availability of this IDiagnosticProfile COM interface?

[Ruuucker]

It presents starting from Windows 7 and the latest version I got is Win10 build 19041 which is also having it.

[hfiref0x]

Do you have proper definition of IDiagnosticProfile interface for all versions starting from win7 up to win11? Does it changes between versions?

I did checked it against 7601 and 17763 and they are seems the same.

[Ruuucker]

Sorry, I dont have definitions nor knowledge/experience in that thing, but I will try to dig in a bit.

[hfiref0x]

I will add this method in the next version, but this could take some time as I don't have any free time for this now. Thanks for your contribution.

You can check the interface layout using IDA, this interface is in diagcpl dll I believe.

[Ruuucker]

Thanks for the hint, I will try it.

[hfiref0x]

This is method 75. It is not a final version and mainly untested. You need properly compiled dlls for akagi to be able to test this method, follow instruction in readme.md, without properly integrated dll this method won't work.

[hfiref0x]

Implemented in b0855e2

[sly9it]

It presents starting from Windows 7 and the latest version I got is Win10 build 19041 which is also having it.

How did you get this compiled in windows 10