UAC Bypass

User Account Control (UAC) is the reason why, even as a member of the administrators group, a normal process starts with a filtered token (without the administrator privileges) until the user approves elevation in the consent dialog. A UAC bypass does not exploit a memory bug: it abuses Microsoft-signed binaries that auto-elevate without showing the dialog and that, by design, read a path or a registry key the user can control. The result is going from a filtered admin token (medium integrity) to a full one (high integrity) without touching the password.

Requirements

The bypass does not turn a plain user into an administrator: it only helps when you already belong to the administrators group but operate with the filtered token. It is the step from "I am an admin but UAC limits me" to "I have a high-integrity process", required before dumping the SAM, touching HKLM or installing a service.

Mechanism

The best-known pattern is fodhelper.exe, an auto-elevating binary that, on startup, reads a registry key under HKCU (which the user can write) to decide what to open. By seeding our command there, fodhelper launches it already elevated:

reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "cmd.exe /c C:\Temp\rev.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v "DelegateExecute" /f
fodhelper.exe

fodhelper starts at high integrity, reads the poisoned key and runs rev.exe with high integrity. The same idea, with a different key, works with eventvwr.exe (mscfile), sdclt.exe, computerdefaults.exe and a long list catalogued by the UACME project. Metasploit ships several of these as exploit/windows/local/bypassuac_* modules.

How to detect it

Before trying it, confirm the current integrity and the UAC level:

whoami /groups | findstr /i "Mandatory Level"
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

A Medium Mandatory Level with Administrators membership is the sign that the token is filtered and the bypass makes sense. With EnableLUA set to 0 there is no UAC to jump (you are already elevated).

Defence. Set UAC to its highest level (Always notify), which forces the dialog even for auto-elevating binaries; do not use administrator accounts for daily work; and watch for anomalous writes to HKCU\Software\Classes\...\shell\open\command, which are almost always a bypass in progress. Related to RunAs with credentials and SeImpersonate + Potato.