Researcher Bypasses Windows UAC by Spoofing Trusted Directory

guest · Nov 12, 2018

Researcher Bypasses Windows UAC by Spoofing Trusted Directory
November 12, 2018
https://www.securityweek.com/researcher-bypasses-windows-uac-spoofing-trusted-directory

Although Microsoft doesn’t consider UAC a security boundary, the feature still brings additional security benefits. UAC alerts users in the Administrators group when a program attempts to run with elevated privileges, so that the user can confirm the action.

Even so, the approach can be abused to bypass UAC, and Tenable’s David Wells recently discovered a new technique that leverages this functionality to ensure that no UAC prompt is displayed when a rogue executable runs.

Executables that can auto-elevate need to be already configured for auto-elevation (in which case an “autoElevate” key exists for that file), to be properly signed, and to run from a Trusted Directory, such as “C:\Windows\System32,” the security researcher explains.

The researcher discovered that, in one of the checks it performs to ensure the executable can auto-elevate, Appinfo.dll (AIS) calls the RtlPrefixUnicodeString API and verifies that the target executable path begins with “C:\Windows\System32\.”
Click to expand...

He was able to create a directory called “C:\Windows \” (it has a space after “Windows”) by using the CreateDirectory API and prepending a “\\?\” to the directory name (to bypass naming filter rules in Windows) and then created a “System32” directory in it.

The researcher also notes that he was able to elevate attacker code by dropping a fake WINMM.dll (imported by winSAT.exe) in the spoofed “C:\Windows\System32\” directory, for a local dll hijack. The researcher also published proof-of-concept code for this UAC bypass technique.
Click to expand...

itman · Nov 12, 2018

I suspect UAC set to maximum level will detect this just as it does for other hidden auto elevation bypasses.

Log in or Sign up

Researcher Bypasses Windows UAC by Spoofing Trusted Directory

guest Guest

itman Registered Member

Log in or Sign up

Researcher Bypasses Windows UAC by Spoofing Trusted Directory

guest Guest

itman Registered Member

Useful Searches