From bd672ae148a2f3e266c14dcb54ec2fb864ad3280 Mon Sep 17 00:00:00 2001 From: gushmazuko <34921843+gushmazuko@users.noreply.github.com> Date: Sun, 8 Apr 2018 12:00:14 +0200 Subject: [PATCH] Description changed --- .../windows/local/bypassuac_sluihijack.rb | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/modules/exploits/windows/local/bypassuac_sluihijack.rb b/modules/exploits/windows/local/bypassuac_sluihijack.rb index c0fc913b5c..739ebf7997 100644 --- a/modules/exploits/windows/local/bypassuac_sluihijack.rb +++ b/modules/exploits/windows/local/bypassuac_sluihijack.rb @@ -29,16 +29,18 @@ class MetasploitModule < Msf::Exploit::Local 'Name' => 'Windows UAC Protection Bypass (Via Slui File Handler Hijack)', 'Description' => %q{ This module will bypass UAC on Windows 8-10 by hijacking a special key in the Registry under - the Current User hive, and inserting a custom command that will get invoked when any binary (.exe) - application is launched. But slui.exe is an auto-elevated binary that is vulnerable to file handler hijacking. - When we run slui.exe with changed Registry key (HKCU:\Software\Classes\exefile\shell\open\command), - it will run our custom command as Admin instead of slui.exe. + the Current User hive, and inserting a custom command that will get invoked when any binary + (.exe) application is launched. But slui.exe is an auto-elevated binary that is vulnerable + to file handler hijacking. When we run slui.exe with changed Registry key + (HKCU:\Software\Classes\exefile\shell\open\command), it will run our custom command as Admin + instead of slui.exe. - The module modifies the registry in order for this exploit to work. The modification is reverted - once the exploitation attempt has finished. + The module modifies the registry in order for this exploit to work. The modification is + reverted once the exploitation attempt has finished. - The module does not require the architecture of the payload to match the OS. If specifying EXE::Custom - your DLL should call ExitProcess() after starting the payload in a different process. + The module does not require the architecture of the payload to match the OS. If + specifying EXE::Custom your DLL should call ExitProcess() after starting the + payload in a different process. }, 'License' => MSF_LICENSE, 'Author' => [