Skip to content

Commit e02adc1

Browse files
committed
Merge branch 'mubix-bypassuac_uac_check'
2 parents 33429c3 + 55474dd commit e02adc1

File tree

1 file changed

+29
-1
lines changed

1 file changed

+29
-1
lines changed

modules/exploits/windows/local/bypassuac.rb

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,35 @@ def exploit
6060
end
6161
}
6262
if not vuln
63-
print_error("#{winver} is not vulnerable.")
63+
print_error("#{winver} does not have UAC")
64+
return
65+
end
66+
67+
root_key, base_key = session.sys.registry.splitkey("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")
68+
open_key = session.sys.registry.open_key(root_key, base_key)
69+
lua_setting = open_key.query_value('EnableLUA')
70+
71+
if lua_setting.data == 1
72+
print_status "UAC is Enabled, checking level..."
73+
else
74+
print_error "UAC is not enabled, no reason to run module, exiting..."
75+
print_error "Run exploit/windows/local/ask to elevate"
76+
return
77+
end
78+
79+
uac_level = open_key.query_value('ConsentPromptBehaviorAdmin')
80+
81+
case uac_level.data
82+
when 2
83+
print_error "UAC is set to 'Always Notify'"
84+
print_error "This module does not bypass this setting, exiting..."
85+
return
86+
when 5
87+
print_good "UAC is set to Default"
88+
print_good "BypassUAC can bypass this setting, continuing..."
89+
when 0
90+
print_error "UAC is not enabled, no reason to run module"
91+
print_error "Run exploit/windows/local/ask to elevate"
6492
return
6593
end
6694

0 commit comments

Comments
 (0)