Reversing User Account Control and Bypassing Tricks
User Account Control (UAC) protection is a security defense designed to prevent malware from gaining administrator privileges. In this chapter, we will reverse-engineer UAC design to understand the internal workflow of UAC protection and learn the techniques used by threat actors to bypass UAC design for privilege elevation.
This chapter is based on the author’s Duplicate Paths Attack: Get Elevated Privilege from Forged Identities presented at Hackers In Taiwan Conference (HITCON) 2019 and Playing Win32 Like a K!NG ;) at Students’ Information Technology Conference (SITCON) 2020. These presentations describe the complete reverse engineering of the UAC protection for Windows 10 Enterprise 17763, and present UAC privilege elevation techniques for all versions of Windows from 7 to 10, based on the path normalization exploit. Interested readers can search for the presentations and full videos of the two sessions.
In...
