4 ms·
I mean, you can easily bypass the UAC dialog by duplicating the token of a already elevated process. Here is an example of this I saw before in powershell: http
by Andoryuuta 9y ago
I mean, you can easily bypass the UAC dialog by duplicating the token of a already elevated process. Here is an example of this I saw before in powershell: https://gist.github.com/tyranid/9ffef5962a642d4a1bb8e4ee7e3bebc5 https://gist.github.com/tyranid/9ffef5962a642d4a1bb8e4ee7e3b...
- TokenDiversity 9y agoThis is very cool but as someone who's not a pro with Windows API or powershell, how safe is this thing assuming a user-space process has been hijacked by an attacker?
- Andoryuuta 9y agoYes, If any malicious program is running in user land in windows, it can easily bypass UAC. But, as was mentioned when this was being discussed on reddit[0], UAC was never meant to be a fix-all security boundary. 0: https://www.reddit.com/r/netsec/comments/6e1uft/a_poc_demonstrating_how_uac_was_fundamentally/di733pw/ https://www.reddit.com/r/netsec/comments/6e1uft/a_poc_demons...