Promptless UAC Bypass & Powershell Privilege Escalation techniques - Hak5 2510

[@JustinHyneswashplant26]

This is so interesting and is very efficient compared to other methods, thank you for the video.

[@TheOxis1]

Hey Darren, I see an added '?' at the end of your ps1 file in the video, but it's not in the original code, I think that's what causing the error in Powershell when you run the script

[@hak5]

Correct! Good eye!

[@ericellenwood]

? is an alias for where-object the message was asking for its parameter

[@jdgregson]

This is NOT a privilege escalation vulnerability. The user must already be a member of the Local Administrators group. This only bypasses the UAC prompt.

[@jdgregson]

Additionally, BitDefender's Advanced Threat Defense blocks this attempt.

[@jdgregson]

@@markdownsouth1500 Bitdefender will block scripts based on what they try to do, so this should be blocked no matter who runs it, while other scripts that don't do suspicious things will run just fine. As for a password bypass, you can set Bitdefender to prevent settings from being changed without a password, but that is not activated by default.

[@NassifDJ]

@@jdgregson could be used to escalate the privilege in a trojan that is already installed but cant do certain things, that can re execute the trojan with admin rights

[@littlemeljoe]

So does this work on a guest account also or only admin

[@glen_nz]

Excellent find Lokiuox! Thanks for sharing Darren! Might have to try to rubberducky this, to demo to my Desktop Support team :)

[@aquatrax123]

And this is why as a Windows admin, I always run applocker to prevent unsigned scripts and exe files from running. What a world of difference applocker has made but it's sad no one else uses it.

[@neoc03]

- if the user can open powershell they can just run it by copying and pasting the entire script into the terminal (takes some minor modification to get it to work). - they can also run "Set-ExecutionPolicy -executionpolicy bypass -scope all" which will allow unsigned scripts to run. I block all non-admin users from using powershell and ISE by GPO - I'm a Windows sysadmin, and I've switched to Linux for all my personal devices if that tells you anything.

[@sturmbreakers7817]

neoc03 And what if you set gpo to prompt for password for everything even if your logged in as administrator?

[@LiEnby]

Wouldn't work, PowerShell and task scheduler are both built in Windows utility's thus they would be "trusted"

[@RobinCawthorne]

@@neoc03 dude, there's loads of priv escalation for Linux as well. Still though, nice to know you're happy and familiar with both OS'

[@neoc03]

@@sturmbreakers7817 it would still bypass it. It elevates in a way that doesn't trip a UAC prompt.

[@luismarrero9293]

it did not work for me. if you have to open powershell as admin and also change execution policy to enable run script what will be the purpose of running the powershell to bypass uac and apply payload. it is really ideal scenario normally will not work because by default poweshell policy is not enable.

[@luvr.]

hello, please response to this! powershell admin works, but what does it do? like does it end up just resetting the search or does it delete/erase half of my files and data. (basically any harm to pc?) please respond i am new to this :(

[@YaboyKelvin]

Hey! So I have some problems with my PC whenever I try to run an app and it gives me the prompt the yes button is grayed out, and it won't let me type in an administrator password. I've looked a bit and noticed that my windows account was set to a guest and the administrator account was gone. How do I fix this?

[@DimusTech]

Well for me the "windir" doesn't exist under HKCU since it's actually a system wide and not users property, so this thing doesn't work for me at all from a non admin user on the PC. Maybe Microsoft updated something and fixed this loophole

[@mrsxber1916]

what software did u use to record this video??

[@quipo1225]

Hi I got a virus on my machine and command prompt came up with a code saying something like prompting UAC privilege escalation, can you help me get this off my machine?

[@mr_redstone6699]

Does this still work after 5 years?

[@neonsalad7gaming301]

Whenever I start up my pc, User Account Controll Windows Powershell keeps popping up and asking me if I want to allow this app to make changes to my device, if I clicked close button or “No” it keeps popping up but when i choose “Yes” nothing happened but my bitdefender keeps prompting me “Malicious application blocked” it bothers me because bit defender just blocked the “application” but i cant get rid of it. Is this a virus? I hope you can help me on this one. 🙏🏽

[@_OOTP_]

It's not really privilege escalation if you have to be admin for it to work... It's just a bypass.

[@Whatsthegeek]

you don't need to be admin to do this. it works for any user on the system (tried it)

[@akz7366]

ok, now where is the tutorial

[@Gameek]

i don't know if you did this or not but i got this idea : how about using the virtual desktop feature to hide rubber ducky's tasks

[@grosgogogogt]

I gust they find a way to secure it running scripts is disabled on this system.

[@firstlast493]

((( "uac.ps1 cannot be loaded because running scripts is disabled on this system"

[@ccollinsio]

Aleksei Buivol that’s an easy fix. Just google the error and copy-paste the solution

[@_OOTP_]

Set-ExecutionPolicy -ExecutionPolicy Bypass :)

[@DoorThief]

Sounds like you did something wrong

[@professor2776]

hey Darren, I forget my admin pass, so now i can't install any apps, i need to install a vpn, if you could help me through this, i wanna install the app withoug UAC pass, if there is any way that you could help me that would highly appreciated

[@j4zzx297]

Ive not learnt powershell but why is a $ a dollor sign and a hash tag (#) a pound sign? Why isn't a £ a pound sign?

[@jarod1701]

J4zz x Because not even the British care about Britain anymore.

[@naveenkumar-nn7iv]

J4zz x their is no ₹ sign either..no complaints

[@nackrr9742]

The power thing keeps popping up and it won't stop, it keeps closing and reopening, please help.

[@antticodes]

I am not very familiar with powershell. So, how could I use this to give myself admin and disable lanschool on my school pc (I have tries alot of stuff found in internet but it's very well protected, and I am too lazy to install linux on usb and try to run it)

[@LiEnby]

Only way to find out is to try it**

[@neoc03]

Most windows enterprise environments are protected against this. It wont allow you to run the task on demand so you can't kick off the process.

[@LiEnby]

@@neoc03 it doesn't matter anyway it only works if your account is an admin allready

[@VG_Precious]

How do you run the script?

[@0dayCTF]

Anywhere here from the Autopsy room on THM?

[@ares-ns]

It isn't easy to find the flag....you must go deep in %appdata%

[@HighnoonVader]

Are you already a local admin on that pc running this? I created a new user account to test on this but it didnt work, even on an unpatched windows 10 vm. Powershell keeps opening a new shell and closes itself and repeats.

[@neoc03]

are you running the script from the shell or copying and pasting the into the shell? It does work.

[@HighnoonVader]

neoc03 running script from the shell. Tried both cmd and powershell.

[@GHOSTNINJASD]

Same here, followed the same steps here. Added a pause and it stops looping but directory never gets created.

[@HighnoonVader]

Yea. Note that this is only bypassing uac, not privsec.

[@siren8624]

The user you're running this as must already be a member of the local administrators group.

[@CHERRY_ED]

can i bypass somthing else them powershell?

[@alexm8807]

You can start other programs from powershell

[@littlemeljoe]

How did you get the uac to turn into ps1

[@ameloskii3086]

just write .ps1 at the end when you save it, also make sure that you have selected to display all files rather than .txt ones when saving

[@makingchangeslifechanges4950]

can you post up how my work can stop users from doing this?

[@rsinistic]

You still need to be admin .click bait . No PE technique here.

[@superq9941]

I get a error windir is not a property

[@rurouni-g2f]

Hello from THM :)

[@coombee1]

Can we see a bash bunny script to Set .PS1 Script To Open With PowerShell By Default instead of opening notepad?

[@Jennn]

Thank You Thank You~!

[@spetsnazrussia2446]

Useful as shell

[@bana2s]

Your documentation for the Bash Bunny is inconsistent and in some places just plain wrong. I was going to write email about it, but all of the Hak5 web sites seem to be down.

[@thegrinch360]

If you are in an environnement which doesn't allow unsigned scripts like correct configured AD, your solution won't work

[@jasonbourne7179]

Approved for 30k.

[@littlemeljoe]

I’m confused

[@AnthonyAnderson-i5k]

Heller Wall

[@SpencerEgbert-r8g]

Boehm Mountains

[@VanishingTacos]

Another reason to run Linux :)

[@TheSkepticSkwerl]

Cause we all know Linux is "more secure" 🙄

[@VanishingTacos]

TheSkepticSkwerl it is 🤔

[@Canadian789119]

whoami root :)

[@RobinCawthorne]

@@VanishingTacos is it though? I think it would be better to be more specific as to which distro you're on about. Some distro's sec is questionable. Still, Linux and the idea behind leaving the source open for all to see takes the cake over anything Microsoft ever had in mind. A little peeved that MS now had a seating at the Linux table. 😔

[@privatprivat6629]

There are more exploits as you think but its not so famous so not so much Information about

[@CyberAbyss007]

Good one. Thanks!

[@shadowflee2]

Good to see you man 🙃

[@shadowflee2]

If you send me the stl I can make some black ones on my printer .

[@JeffreyPrice-y8r]

Ari Burg

[@ccollinsio]

The first non-admin script you run should be to make yourself admin. If your username is “dk” Run this: net localgroup Administrators dk /add

[@ccollinsio]

mark downsouth no kidding Sherlock lol did you watch the video? Darren shows you how to bypass that

[@_OOTP_]

@@ccollinsio it only bypasses UAC if you're already an admin.

[@IamJakoby]

Obviously this being old this method is patched but I did a video on a new method I found. I have it formatted to use as a function as well and make it too easy. kzbin.info/www/bejne/pHOxnqimfqd8a5Y

[@tenkei000]

You're "new method" is not a UAC bypass. It can be useful to have scripts hit the UAC accept but don't sell it as a replacement for this. On top of that self promotion on someone else's video is rude.

[@IamJakoby]

@@tenkei000 2 things, its just a hardware uac bypass so very niche but very in line for this channels content considering you need to use their device. i also won an award for that specific payload from hak5, and it was one of the payloads i submitted that got me to win hak5 hacker of the year. but youre heart is in the right place

[@tenkei000]

@@IamJakoby Please correct me if I am wrong. Darren's example is a bypass that allows for privilege escalation. Yours allows for Ducky Scripts to accept the UAC but would require you to already be a user with elevated permissions. If this is the case these are on two different levels and your original post on this video is miss leading. Yours doing more than I saw it doing in your video or not I do, as a owner of a Bash Bunny, appreciate your contributions but lets keep things clear on what we are talking about.

[@IamJakoby]

@tenkei000 well neither is technically privilege escalation. He has to be an elevated user as well. But like I said it got patched, and so did both of my versions I shared publicly. Once they were burned I didn't want to burn anymore so I made a hardware version that would work for their purposes That's all it is at the end of the day

[@tenkei000]

@@IamJakoby Well damn Darren... my whole problem was I trusted his title. I just re-watched his video, your right it is not a priv escalation. My bad, y'alls technique is in the same category. I was trying to call you out for being miss leading and it was the Hak5 man himself.....

[@PilotPlater]

I always thought UAC was a joke.

[@Canadian789119]

For the special users S-1-3-135- blah blah. Ofc. man.

[@sunclonkt7839]

wow 8min --__--

[@night_hunterz2596]

Nice man...

[@GlitchyChris]

wow nice

[@Geisterhebel]

Awesome :D

[@badasscarstracks]

Neat.

[@superq9941]

Epic

[@zombo611]

For systems that block running. ps1 files, try opening the poweshell_ise. exe paste the code and hit F5 key.. Quack Style

[@poshmag1c0deposh69]

Encode it and run it....or encode a downloader tat downloads it as a string and invoke-expression it. If the script is big the encoding will be big and will not fit on run line so will need to be launch in the cmd interpreter.

[@neoc03]

@Harry open powershell and enter "set-executionpolicy -executionpolicy bypass -scope all"

[@d.velkov1-vi26]

!!!How to bypass icloud!!!

[@VanishingTacos]

!!no!!

[@privatprivat6629]

Nooo

[@DAVIDGREGORYKERR]

I would rather that you didn't do this as this means that hackers will get access to computers that they should not have access to.

[@hackedemy9324]

Sir I think that's what hacking is about

[@dxfvgyhjh]

@@hackedemy9324 lmao

[@PyPylia]

3rd

[@WalterSherry-f2b]

Pfannerstill Valley