{"id":19499922,"url":"https://github.com/tijme/cmstplua-uac-bypass","last_synced_at":"2025-04-25T22:34:51.695Z","repository":{"id":61116103,"uuid":"546892778","full_name":"tijme/cmstplua-uac-bypass","owner":"tijme","description":"Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.","archived":false,"fork":false,"pushed_at":"2022-10-09T15:14:17.000Z","size":1950,"stargazers_count":111,"open_issues_count":1,"forks_count":22,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-05-02T03:23:44.031Z","etag":null,"topics":["beacon","bof","cobalt-strike","exploit","red-teaming","uac-bypass"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tijme.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-10-06T20:28:22.000Z","updated_at":"2024-04-22T12:51:55.000Z","dependencies_parsed_at":"2022-10-11T06:43:34.904Z","dependency_job_id":null,"html_url":"https://github.com/tijme/cmstplua-uac-bypass","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Fcmstplua-uac-bypass","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Fcmstplua-uac-bypass/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Fcmstplua-uac-bypass/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Fcmstplua-uac-bypass/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tijme","download_url":"https://codeload.github.com/tijme/cmstplua-uac-bypass/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224019605,"owners_count":17242177,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["beacon","bof","cobalt-strike","exploit","red-teaming","uac-bypass"],"created_at":"2024-11-10T22:06:45.607Z","updated_at":"2024-11-10T22:06:47.000Z","avatar_url":"https://github.com/tijme.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\r\n    \u003cimg src=\"https://raw.githubusercontent.com/tijme/uac-bypass-cmstplua/master/.github/logo.png\" width=\"650\"/\u003e\r\n\u003c/p\u003e\r\n\u003cp align=\"center\"\u003e\r\n    \u003ca href=\"https://github.com/tijme/uac-bypass-cmstplua/blob/master/LICENSE.md\"\u003e\u003cimg src=\"https://raw.finnwea.com/shield/?firstText=Source\u0026secondText=Licensed\" /\u003e\u003c/a\u003e\r\n    \u003cbr/\u003e\r\n    \u003cb\u003eCobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.\u003c/b\u003e\r\n    \u003cbr/\u003e\r\n    \u003csup\u003eBuilt by \u003ca href=\"https://www.linkedin.com/in/tijme/\"\u003eTijme\u003c/a\u003e. Credits to \u003ca href=\"https://github.com/lldre\"\u003eAlex\u003c/a\u003e for teaching me! Made possible by \u003ca href=\"https://northwave-security.com/\"\u003eNorthwave Security\u003c/a\u003e \u003cimg src=\"https://raw.githubusercontent.com/tijme/uac-bypass-cmstplua/master/.github/northwave.png\"/\u003e\u003c/sup\u003e\r\n    \u003cbr/\u003e\r\n\u003c/p\u003e\r\n\r\n## Description\r\n\r\nThis is a Cobalt Strike (CS) Beacon Object File (BOF) which exploits the CMSTPLUA COM interface. It masquerade the PEB of the current process to a Windows process, and then utilises COM Elevation Moniker on the CMSTPLUA COM object in order to execute commands in an elevated context.\r\n\r\n\u003cp align=\"center\"\u003e\r\n    \u003cimg src=\"https://raw.githubusercontent.com/tijme/uac-bypass-cmstplua/master/.github/output.png\" /\u003e\r\n\u003c/p\u003e\r\n\r\n## Usage\r\n\r\nClone this repository first. Then review the code, compile from source and use it in Cobalt Strike.\r\n\r\n**Compiling**\r\n\r\n\tmake\r\n\r\n**Usage**\r\n\r\nLoad the `UACBypassCMSTPLUA.cna` script using the Cobalt Strike Script Manager. Then use the command below to execute a command while bypassing UAC.\r\n\r\n    $ uac_bypass_cmstplua [FILE] [PARAMETERS]\r\n\r\nFor example, to copy a file use:\r\n\r\n    $ uac_bypass_cmstplua powershell Copy-Item C:\\temp\\BluetoothApis.dll C:\\System32\\Windows\\BluetoothApis.dll\r\n\r\nTo show a `whoami` on screen:\r\n\r\n    $ uac_bypass_cmstplua cmd /k whoami\r\n\r\n## Warning\r\n\r\n* This BOF spawns a new process (in which UAC is bypassed).\r\n* This BOF does not read the output of the spawned process.\r\n* This BOF does not bypass UAC on the beacon process itself.\r\n\r\n## Issues\r\n\r\nIssues or new features can be reported via the [issue tracker](https://github.com/tijme/uac-bypass-cmstplua/issues). Please make sure your issue or feature has not yet been reported by anyone else before submitting a new one.\r\n\r\n## License\r\n\r\nCopyright (c) 2022 Tijme Gommers \u0026 Northwave Security. All rights reserved. View [LICENSE.md](https://github.com/tijme/uac-bypass-cmstplua/blob/master/LICENSE.md) for the full license.\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftijme%2Fcmstplua-uac-bypass","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftijme%2Fcmstplua-uac-bypass","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftijme%2Fcmstplua-uac-bypass/lists"}