Windows Escalate UAC Protection Bypass (In Memory Injection) Abusing WinSXS
Posted by deepcore on October 13, 2017 – 2:13 pm
This Metasploit module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off by abusing the way “WinSxS” works in Windows systems. This Metasploit module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three separate binaries in the standard technique. However, it requires the correct architecture to be selected, (use x64 for SYSWOW64 systems also).
Post a reply
You must be logged in to post a comment.