Reply to thread

Message

<blockquote data-quote="In2an3_PpG" data-source="post: 775682" data-attributes="member: 56957"><a href="https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e" target="_blank">UAC Bypass by Mocking Trusted Directories – Tenable TechBlog – Medium</a>Author/Researcher, <a href="https://medium.com/@dwells_39774" target="_blank">David Wells – Medium</a>During research for some new User Account Control (UAC) bypass techniques, I discovered what I believe to be a new bypass method (at the time of this writing). It is worth mentioning that <a href="https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac/" target="_blank">Microsoft doesn’t consider UAC a security boundary</a>, however we still reported the bug to Microsoft and want to share its details here. This method was successfully tested against Windows 10 Build 17134. Before I dive into the details of the bypass, I will first offer a short primer on UAC and its quirks for those unfamiliar with some of it’s inner-workings.</blockquote>

[QUOTE="In2an3_PpG, post: 775682, member: 56957"] [URL="https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e"]UAC Bypass by Mocking Trusted Directories – Tenable TechBlog – Medium[/URL] Author/Researcher, [URL="https://medium.com/@dwells_39774"]David Wells – Medium[/URL] During research for some new User Account Control (UAC) bypass techniques, I discovered what I believe to be a new bypass method (at the time of this writing). It is worth mentioning that [URL='https://blogs.msdn.microsoft.com/e7/2009/02/05/update-on-uac/']Microsoft doesn’t consider UAC a security boundary[/URL], however we still reported the bug to Microsoft and want to share its details here. This method was successfully tested against Windows 10 Build 17134. Before I dive into the details of the bypass, I will first offer a short primer on UAC and its quirks for those unfamiliar with some of it’s inner-workings. [/QUOTE]

Verification