Bypassing Windows 10 UAC with mock folders and DLL hijacking

guest · Jul 31, 2020

Bypassing Windows 10 UAC with mock folders and DLL hijacking
July 31, 2020
https://www.bleepingcomputer.com/ne...s-10-uac-with-mock-folders-and-dll-hijacking/

A new technique uses a simplified process of DLL hijacking and mock directories to bypass Windows 10's UAC security feature and run elevated commands without alerting a user.

Last month BleepingComputer reported how security researcher Wietze Beukema found that 300 Windows executables were vulnerable to DLL hijacking that allows attackers to bypass the UAC security feature.
Building on the same technique, security researcher and pentester Daniel Gebert illustrates how Windows 10 User Account Control (UAC) can also be bypassed through a combination of DLL hijacking techniques and mock directories.
Click to expand...

Introducing Windows 10 mock directories
A mock directory is an imitation directory with a trailing space. For example, whereas "C:\Windows\System32" is a legitimate, trusted location on Windows machines, a mock directory would look like "C:\Windows\ System32" (notice the trailing space after Windows\).

The treating of a mock folder as the actual folder it's named after, is where directories come into play. [...]
Click to expand...

The takeaway
Gebert has mentioned numerous other examples on his blog describing how this UAC bypass technique can be abused, for example, to bypass Software Restriction Policies (SRP).
Gebert's straightforward mitigation advice to prevent UAC bypass attacks is setting UAC to "Always Notify." Doing so will always show the user UAC prompts before high-risk applications are executed.
Click to expand...

Log in or Sign up

Bypassing Windows 10 UAC with mock folders and DLL hijacking

guest Guest

Log in or Sign up

Bypassing Windows 10 UAC with mock folders and DLL hijacking

guest Guest

Useful Searches