UAC Bypasses
Last updated
Last updated
User Account Control (UAC) is a technology that exists in Windows which forces applications to prompt for consent when requesting an administrative access token. Bob is a local administrator on Workstation 2 - but if we open a Command Prompt and attempt to add a new local user, we get an access denied. This instance of cmd.exe is running in "medium integrity".
\
Instead, what we must do is right-click and select "Run as administrator", which will cause a UAC prompt to appear.
\
\
Only after clicking Yes will the Command Prompt have sufficient privileges to make system configuration changes, as it will now be running in "high integrity".
\
A UAC "bypass" is a technique that allows a medium integrity process to elevate itself or spawn a new process in high integrity, without prompting the user for consent. Being in high integrity is important for attackers because it's required for various post-exploitation actions such as dumping credentials.
Beacon has a few built-in UAC bypasses and a few more which are provided via the Elevate Kit (this has already been pre-loaded into Cobalt Strike for your convenience). These are exposed via the elevate command.
\
\
