{"id":21525657,"url":"https://github.com/0xlane/bypassuac","last_synced_at":"2025-04-06T00:08:21.126Z","repository":{"id":45643336,"uuid":"256767961","full_name":"0xlane/BypassUAC","owner":"0xlane","description":"Use ICMLuaUtil to Bypass UAC!","archived":false,"fork":false,"pushed_at":"2020-04-19T08:44:37.000Z","size":14835,"stargazers_count":534,"open_issues_count":0,"forks_count":71,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-29T23:08:02.460Z","etag":null,"topics":["bypass","bypass-uac","bypassuac","red-team","uac","windows"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xlane.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-18T14:02:35.000Z","updated_at":"2025-03-29T17:17:42.000Z","dependencies_parsed_at":"2022-07-19T13:02:41.916Z","dependency_job_id":null,"html_url":"https://github.com/0xlane/BypassUAC","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2FBypassUAC","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2FBypassUAC/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2FBypassUAC/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2FBypassUAC/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xlane","download_url":"https://codeload.github.com/0xlane/BypassUAC/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247415969,"owners_count":20935388,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bypass","bypass-uac","bypassuac","red-team","uac","windows"],"created_at":"2024-11-24T01:37:58.066Z","updated_at":"2025-04-06T00:08:21.092Z","avatar_url":"https://github.com/0xlane.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BypassUAC\n\n利用`Autoelevated`属性的`COM`接口配合`PEB`伪装实现`BypassUAC`，分成了`C`和`C#`版本！\n\n代码摘自：\n- [UACMe](https://github.com/hfiref0x/UACME)\n- [p0wnedShell](https://github.com/Cn33liz/p0wnedShell)\n\n# 什么类型的`COM interface`可以利用？\n\n以`UACMe`项目中索引为`41`的方法为例：\n```\nAuthor: Oddvar Moe\nType: Elevated COM interface\nMethod: ICMLuaUtil\nTarget(s): Attacker defined\nComponent(s): Attacker defined\nImplementation: ucmCMLuaUtilShellExecMethod\nWorks from: Windows 7 (7600)\nFixed in: unfixed 🙈\nHow: -\n```\n该方法的目标接口是`ICMLuaUtil`，对应`Akagi`项目中具体实现函数为`ucmCMLuaUtilShellExecMethod`，在项目中的`methods/api0cradle.c`文件中可以找到该方法的定义：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418134804.png)\n观察发现这里利用的是`CMSTPLUA`组件的`ICMLuaUtil`接口。\n\n我的测试系统`Windows 10 (1909)`，使用[OleViewDotNet](https://github.com/tyranid/oleviewdotnet)工具可以查看系统中的`COM`接口属性信息，注意需要以管理员权限运行。\n\n打开`CLSIDs`窗口搜索`cmstplua`，可以快速定位该组件：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418135050.png)\n右键查看`CMSTPLUA`组件的`Elevation`属性：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418141937.png)\n这里的`Enabled`和`Auto Approval`值都是`True`表示这个组件可以用来绕过`UAC`认证，这是第一点。\n\n第二点是目标接口`ICMLuaUtil`需要有一个可以执行命令的地方，通过在`CISIDs`窗口鼠标悬浮在`ICMLuaUtil`上，可以看到该接口对应的二进制文件为`cmlua.dll`：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418144454.png)\n\n虚函数偏移为`cmlua.dll+0x6360`，通过`IDA`打开该系统文件(`c:\\windows\\system32\\cmlua.dll`)，跳到虚函数表的位置，可以看到`ICMLuaUtil`接口的虚函数表：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418145430.png)\n\n摘出来看接口函数如下：\n```csharp\n01 QueryInterface(_GUID const \u0026,void * *)\n02 AddRef(void)\n03 Release(void)\n04 SetRasCredentials(ushort const *,ushort const *,ushort const *,int)\n05 SetRasEntryProperties(ushort const *,ushort const *,ushort * *,ulong)\n06 DeleteRasEntry(ushort const *,ushort const *)\n07 LaunchInfSection(ushort const *,ushort const *,ushort const *,int)\n08 LaunchInfSectionEx(ushort const *,ushort const *,ulong)\n09 CreateLayerDirectory(ushort const *)\n10 ShellExec(ushort const *,ushort const *,ushort const *,ulong,ulong)\n11 SetRegistryStringValue(int,ushort const *,ushort const *,ushort const *)\n12 DeleteRegistryStringValue(int,ushort const *,ushort const *)\n13 DeleteRegKeysWithoutSubKeys(int,ushort const *,int)\n14 DeleteRegTree(int,ushort const *)\n15 ExitWindowsFunc(void)\n16 AllowAccessToTheWorld(ushort const *)\n17 CreateFileAndClose(ushort const *,ulong,ulong,ulong,ulong)\n18 DeleteHiddenCmProfileFiles(ushort const *)\n19 CallCustomActionDll(ushort const *,ushort const *,ushort const *,ushort const *,ulong *)\n20 RunCustomActionExe(ushort const *,ushort const *,ushort * *)\n21 SetRasSubEntryProperties(ushort const *,ushort const *,ulong,ushort * *,ulong)\n22 DeleteRasSubEntry(ushort const *,ushort const *,ulong)\n23 SetCustomAuthData(ushort const *,ushort const *,ushort const *,ulong)\n```\n其中第`10`个函数`ShellExec`从`IDA`中看到该函数调用了`ShellExecuteEx`这个`Windows API`实现了命令执行：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418150611.png)\n\n通过对`ICMLuaUtil`接口的分析，可以看出可以用来`BypassUAC`执行命令的`COM`组件需要有两个特点：\n1. `elevation`属性启用，且开启`Auto Approval`；\n2. `COM`组件中的接口存在可以命令执行的地方，例如`ICMLuaUtil`的`ShellExec`；\n\n# 如何快速找到系统中的所有可利用的`COM`组件？\n\n除了通过上面的方式在`OleView`中手动去找，还可以通过`UACMe`项目提供的`Yuubari`工具快速查看系统`UAC`设定信息以及所有可以利用的程序和`COM`组件，使用方法如下：\n\n使用`VS2019`加载`Yuubari`，生成后会得到二进制文件`UacInfo64.exe`，运行后在同目录生成一个`log`文件记录所有输出结果：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418180819.png)\n从这里面可以找到所有的`Autoelevated COM objects`，包括`CMSTPLUA`组件的信息：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418182947.png)\n\n\n# 定位`ICMLuaUtil`的虚函数表`vftable`\n\n通过分析`UACMe`中的`ucmCMLuaUtilShellExecMethod`实现可以知道想要利用`COM`接口，需要知道这几个东西：\n- 标识`COM`组件的`GUID`，即`CLSID`\n- 标识`interface`的`GUID`，即`IID`\n- 该接口的虚函数表，主要用来找到`ShellExec`的函数偏移\n\n前两个可以很容易找到，虚函数表可以通过`OleView`提示的虚函数表位置偏移找到，这里再说一种通用的方法，完全利用`IDA`。\n\n第一步，用`IDA`打开`cmlua.dll`；\n第二步，在左侧函数列表中搜索`destructor`或者`constructor`，双击后跳转后，上下找找可以看到调用`vftable`的地方：\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418153457.png)\n双击跳转到变量定义位置，就可以找到虚函数表！\n![](https://raw.githubusercontent.com/cnsimo/pic_bed/master/20200418145430.png)\n\n\u003e 参考：[Get interface definition of undocumented COM objects](https://reverseengineering.stackexchange.com/questions/19947/get-interface-definition-of-undocumented-com-objects)\n\n# 实现部分\n\n直接参考代码实现。","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xlane%2Fbypassuac","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xlane%2Fbypassuac","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xlane%2Fbypassuac/lists"}