|
@taviso | |||||
|
Interesting question, is this a UAC bypass? My first thought is no, because UIPI means you can't automate the interaction. Therefore, the only way to exploit it is if you could have just clicked OK in the UAC consent anyway.... right? (yes, I know UAC is not a supported boundary) twitter.com/harr0ey/status…
|
||||||
|
||||||
|
David Wells
@CE2Wells
|
30. pro |
|
could be if you use SendInput or SetCursorPos to get around UIPI.
|
||
|
||
|
|
Tavis Ormandy
@taviso
|
31. pro |
|
That's what UIPI is supposed to prevent. If you know a way around it, that's probably a real vulnerability, because you could (for example) do it to the consent dialog..
|
||
|
|
||
![Felix aka [xi-tauw]](https://pbs.twimg.com/profile_images/2570315036/c30p9ihncv66teu03rmc_normal.jpeg)
|
Felix aka [xi-tauw]
@PsiDragon
|
31. pro |
|
I converted this into UAC bypass some time ago. amonitoring.ru/article/uac_by…
|
||
|
|
||
|
MaTt
@harr0ey
|
31. pro |
|
Agreed, although I see that cobalt strike has a UAC bypass which asks the victims to click on yes or no, so, If UAC bypass operation should happen without interaction, why does the method of Cobalt strike UAC bypass asks the victim to click yes or no to get the administrator?
|
||
|
|
||
|
Ori Damari
@0xrepnz
|
1. sij |
|
I guess the method in cobalt strike is used to "trick" to user to click yes. UAC is not meant to prevent stupid users from clicking yes.. The method in cobalt strike is not really a UAC bypass either..
|
||
|
|
||
|
bohops
@bohops
|
30. pro |
|
I was always under the impression that the goal of UAC bypass was to run an elevated payload without interaction.
Maybe such cases where interaction avoids the "sanity prompt" can be considered a bypass as well?
I think its a stretch, IMO.
|
||
|
|
||
|
Yunhai Zhang
@_f0rgetting_
|
31. pro |
|
If this is a UAC bypass, then almost all high integrity process with UI is a UAC bypass, so ...
|
||
|
|
||
|
|
Ori Damari
@0xrepnz
|
1. sij |
|
This is not a UAC bypass. Look here for another example:
twitter.com/z3roTrust/stat…
|
||
|
|
||