Add COM class ID hijack method for bypassing UAC

[OJ]

This PR adds a module for bypassing UAC on Windows 7 through 10 utilising the COM hijacking method that @enigma0x3 discovered and used for persistence. The module was inspired by the content that was produced by @FuzzySecurity and his work for Defcon 25 that abused this work to bypass UAC.

The bypass works on all levels except for Always Notify (I've got something else coming for that soon based on work from @tyranid and @FuzzySecurity).

Pictures speak a thousand words:

The module has to drop a DLL on disk. Obviously with default MSF payloads, AV will probably fire. Some other things to note:

• To bypass the 740 error when invoking the binaries directly, we're using cmd.exe to launch them. This will be a problem if cmd.exe is blocked, and so we might have to come up with another method for managing that.
• There is a small sleep in the module that allows for the target program to run before any attempted clean up happens.

Verification

• Create handlers/sessions on a Windows machine or two under the context of a local admin user (but don't run them elevated).
• Run the module a few times to make sure that both of the methods are tested (ie. Computer Management and Event Viewer).
• Sessions created with the module bypass UAC correctly (ie. getsystem works on the new session).
• Make sure that errors are shown when payload architecture does not match the system architecture.
• Make sure that all the authors and references are correct (this is important!)
• Make sure the disclosure date is correct (I'm not sure what to put here).

Thanks to everyone mentioned for their prior work!

[OJ]

Documentation added. Should be good to go!

[busterb]

Looks great, thanks @OJ

[busterb]

Release Notes

A module for bypassing UAC on Windows 7-10 has been added to the framework. It utilizes the COM hijacking method that @enigma0x3 discovered and used for persistence. The module was inspired by the content that was produced by @FuzzySecurity and his work for Defcon 25 that abused this work to bypass UAC.

[OJ]

Great stuff. Thank you Brent!

…

On Aug 21, 2017 04:58, "Brent Cook" ***@***.***> wrote: Release Notes This adds a module for bypassing UAC on Windows 7 through 10 utilising the COM hijacking method that @enigma0x3 <https://github.com/enigma0x3> discovered and used for persistence. The module was inspired by the content that was produced by @FuzzySecurity <https://github.com/fuzzysecurity> and his work for Defcon 25 that abused this work to bypass UAC. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#8789 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABw4EvXoHPfbKSE7kb1FNWnWiz9zLljks5saIHPgaJpZM4On4nH> .