Enigma Fileless UAC Bypass
Posted by deepcore on January 10, 2017 – 12:58 pm
This Metasploit module is an implementation of fileless uac bypass using cmd.exe instead of powershell.exe (OJ msf module). This module will create the required registry entry in the current user’s hive, set the default value to whatever you pass via the EXEC_COMMAND parameter, and runs eventvwr.exe (hijacking the process being started to gain code execution).
Post a reply
You must be logged in to post a comment.