Windows Escalate UAC Protection Bypass Via SilentCleanup
Posted by deepcore on June 29, 2019 – 2:42 pm
There’s a task in Windows Task Scheduler called “SilentCleanup” which, while it’s executed as Users, automatically runs with elevated privileges. When it runs, it executes the file %windir%system32cleanmgr.exe. Since it runs as Users, and we can control user’s environment variables, %windir% (normally pointing to C:Windows) can be changed to point to whatever we want, and it’ll run as admin.
Post a reply
You must be logged in to post a comment.