UAC bypass via "ms-windows-store://" handler hijack & WSReset.exe trigger

hfiref0x / UACME

Defeating Windows User Account Control

BSD 2-Clause "Simplified" License

6.14k stars 1.3k forks source link

UAC bypass via "ms-windows-store://" handler hijack & WSReset.exe trigger #97

Closed AzAgarampur closed 3 years ago

AzAgarampur commented 3 years ago

Hello,

I have method https://github.com/AzAgarampur/byeintegrity7-uac/ that is pretty simple and would be nice if it is included. Title of this issue says it all, and it should work from Windows 8 and above. It uses classic UserAssocSet signatures as always, so I've only included latest W10 & 8 signatures in them, just like before.

Thanks.

hfiref0x commented 3 years ago

Also there is 3rd way which I think is good:

1. Enumerate `HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications`

2. Find value which data string contains `"WindowsStore"`

3. Open key `HKCU` + found data string + `\URLAssociations`

4. Enumerate values of this key until `ms-windows-store` name is found

5. Data of this key contains the correct `AppX...` name.

This one looks promising. Will try that method.

hfiref0x commented 3 years ago

The last commit is working for me on 19042, however things still need to be tested on different Windows 10 variants.

hfiref0x commented 3 years ago

I've finished testing this method implementation. It works fine on 17763(+LTSC)/18362/18363/19041/19042/19043 and insider preview 213xx builds.

3.5.5 version of uacme will be released tomorrow. Thanks for sharing.

hfiref0x commented 3 years ago

Complete.