Skip to content
Pwnversity

UAC Bypass

UAC (User Account Control) makes processes run by default with a medium-integrity token even for an administrator; for privileged operations the consent prompt appears. A UAC bypass means getting a high-integrity process without that prompt, starting from an account that is already a member of Administrators. It isn’t user-to-admin escalation: it’s going from “limited admin” to “full admin” silently.

Threat model

Section titled “Threat model”

Microsoft is explicit that UAC is not a security boundary, just a convenience to reduce accidental privileged execution. That’s why bypasses are abundant and often not patched as vulnerabilities. An attacker already controlling an admin session uses a UAC bypass to self-elevate without alerting the user with a prompt, as a precursor to dumping credentials or persisting.

Requirements

Section titled “Requirements”
  • The account must belong to the Administrators group (split token). If not, you don’t need UAC but real privesc (see Windows Privilege Escalation).
  • The UAC level matters: at maximum (“Always notify”) many bypasses fail.

Red Team

Section titled “Red Team”

Classic techniques (auto-elevating binaries + hijack)

Section titled “Classic techniques (auto-elevating binaries + hijack)”

Windows has signed binaries that auto-elevate without a prompt (autoElevate=true in their manifest). If one reads a path/registry the user controls, code slips into high integrity:

  • fodhelper.exe — reads HKCU\Software\Classes\ms-settings\Shell\Open\command; plant your command there and it runs elevated (the classic, no file on disk needed).
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "cmd.exe /c start cmd.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /f
fodhelper.exe
  • computerdefaults.exe — same technique as fodhelper with another key.
  • eventvwr.exe — hijack of HKCU\Software\Classes\mscfile\shell\open\command (historical).
  • sdclt.exe, slui.exe, wsreset.exe — registry-hijack variants.
  • DLL hijacking in IFEO / auto-elevated paths and mock trusted directories (C:\Windows \System32\ with a space) to bypass path checks.
  • Token manipulation: duplicate another elevated process’s high-integrity token (COM moniker Elevation:Administrator).

The live, classified catalog is in UACME (dozens of numbered methods).

Tools

Section titled “Tools”
  • UACME — reference collection of numbered, maintained bypasses.
  • Metasploit bypassuac_* modules.
  • SharpBypassUAC, PowerShell scripts (Invoke-EventVwrBypass, etc.).

Impact

Section titled “Impact”

A high-integrity process without a prompt: now you can dump LSASS/SAM, disable defenses with full rights, install services, and persist. It’s the silent step between initial admin access and full host control.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • Auto-elevated processes (fodhelper.exe, computerdefaults.exe, eventvwr.exe, sdclt.exe) launching cmd.exe/powershell.exe → anomalous parent-child chain.
  • Writes to HKCU\Software\Classes\...\shell\open\command and ms-settings/mscfile keys.
  • High-integrity processes with no recorded consent.

Telemetry

Section titled “Telemetry”

Sysmon event 1 (process create with parent) and 13 (registry set on the hijack keys); monitor HKCU Run/Classes keys.

Hardening

Section titled “Hardening”
  • Raise UAC to “Always notify” (defeats many auto-elevation bypasses).
  • Apply AppLocker/WDAC to restrict which binaries run, cutting bypass LOLBins.
  • Don’t use admin accounts for daily work: if the session isn’t admin, UAC bypass doesn’t apply.
  • Remove redundant local-admin rights; monitor the hijack registry keys.

Response

Section titled “Response”

Assume high-integrity compromise: treat the host as fully compromised, rotate secrets, review persistence; fix the practice of interactive admin accounts.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • Most bypasses get no CVE because Microsoft doesn’t treat UAC as a security boundary; they’re cataloged in UACME (method #33 fodhelper, etc.).
  • Used by real malware: Dridex, TrickBot, Emotet, Lokibot use fodhelper/eventvwr to self-elevate (MITRE T1548.002).
  • CMSTP, DiskCleanup, ICMLuaUtil among the COM/LOLBins exploited in documented campaigns.

Testing checklist

Section titled “Testing checklist”
  • Is the account a member of Administrators (split token)?
  • UAC level below “Always notify”?
  • fodhelper / computerdefaults via ms-settings registry hijack
  • eventvwr / sdclt / wsreset hijack variants
  • Does AppLocker/WDAC block the bypass LOLBins?
  • Token duplication from an elevated process (COM elevation moniker)
  • Does UACME method X work on this build?

References

Section titled “References”