Last active
December 25, 2017 06:41
-
-
Save slayerlab/7f92978aea5fa6a73250c1c991ab7254 to your computer and use it in GitHub Desktop.
1st Windows PoC: Set 0 REG_DWORD value (through RegSetValueEx) into EnableLUA key for UAC definitively disable.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <windows.h> | |
#if defined(_WIN64) | |
# define REGKEY_BIT KEY_WOW64_32KEY | |
#else | |
# define REGKEY_BIT KEY_WOW64_64KEY | |
int main(int argc, char *argv[]) | |
{ | |
HKEY hKey; | |
LONG rRegOpen; | |
LONG rSetVal; | |
DWORD dwData = 0x00000001; | |
/* Equivalent to: | |
* REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system" | |
* /t REG_DWORD /d 0 /f | |
* | |
* According to MSDN: | |
* RegOpenKeyEx function [RegOpenKeyExW = UNICODE] | |
* LONG WINAPI RegOpenKeyExW( | |
* _In_ HKEY hKey, | |
* _In_opt_ LPCTSTR lpSubKey, | |
* _In_ DWORD ulOptions, | |
* _In_ REGSAM samDesired, | |
* _Out_ PHKEY phResult | |
* ); | |
*/ | |
rRegOpen = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"), 0, KEY_WRITE|REGKEY_BIT, &hKey); | |
if (ERROR_SUCCESS != rRegOpen) { | |
printf("[>] Unable to open registry key: %lu\n", GetLastError()); | |
RegCloseKey(hKey); | |
} | |
else { | |
printf("[*] RegOpenKeyEx() is opened.\n"); | |
} | |
/* According to MSDN: | |
* RegSetValueEx function [RegSetValueExW = UNICODE] | |
* LONG WINAPI RegSetValueEx( | |
* _In_ HKEY hKey, | |
* _In_opt_ LPCTSTR lpValueName, | |
* _Reserved_ DWORD Reserved, | |
* _In_ DWORD dwType, | |
* _In_ const BYTE *lpData, | |
* _In_ DWORD cbData | |
* ); | |
*/ | |
rSetVal = RegSetValueEx(hKey, _T("EnableLUA"), 0, REG_DWORD, (LPBYTE)&dwData, sizeof(dwData)); | |
if (ERROR_SUCCESS != rSetVal) { | |
printf("[>] Could not set the category EnableLUA: %lu\n", GetLastError()); | |
return FALSE; | |
} | |
else printf("[*] The EnableLUA has been set successfully to 0x%.8X (%u).\n", dwData, dwData); | |
RegCloseKey(hKey); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment