• Stars
    star
    100
  • Rank 338,948 (Top 7 %)
  • Language
    C++
  • Created over 1 year ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

CompMgmtLauncher & Sharepoint DLL Search Order hijacking UAC/persist via OneDrive

CompMgmtLauncher & Sharepoint DLL Search Order hijacking UAC/persist via OneDrive

CompMgmtLauncher.exe is vulnerable to to a DLL Search Order hijacking vulnerability. The binary, will perform a search within user env for the DLL's Secur32.dll or Wininet.dll when Onedrive is installed. CompMgmtLauncher.exe has autoelavate enabled on some versions of Windows 10. This can be exploited using a Proxy DLL to execute code as autoelevate is enabled and OneDrive is installed by default on Windows 10 Desktop. On Windows 11 this provides a useful persistence capability in Microsoft.Sharepoint.exe.

The UAC bypass issue has a fix in Windows 10 1703 and up as the manifest runs asInvoker, preventing misuse for UAC elevation, but does not patch the DLL sideloading and persistence capability. OneDrive must be installed to exploit the issue, which is a default configuration on Windows 10.

Injecting into CompMgtLauncher.exe behaves differently on x64 and x86, DLL sideloading maybe most stable with wininet x86. You can also use this to persist and sideload via Microsoft.Sharepoint.exe which reads from the OneDrive location. To exploit via OneDrive, you have to find OneDrive version for path which is a moving target but could be enumerated from the host.

This exploit has been tested against the following product versions:

  • Windows 10 1507 x64 (tested - not vuln.)
  • Windows 10 1511 x64 (vulnerable)
  • Windows 10 1607 x64 (tested - not vuln)
  • Windows 11 21996.1 x64 (Persistence / LOLbin / Microsoft.Sharepoint.exe)

These files are available under a Attribution-NonCommercial-NoDerivatives 4.0 International license.

More Repositories

1

iscsicpl_bypassUAC

UAC bypass for x64 Windows 7 - 11
C++
727
star
2

exploits

exploits and proof-of-concept vulnerability demonstration files from the team at Hacker House
C
389
star
3

Marble

The CIA's Marble Framework is designed to allow for flexible and easy-to-use obfuscation when developing tools.
C++
224
star
4

SignToolEx

Patching "signtool.exe" to accept expired certificates for code-signing.
C++
219
star
5

Stinger

CIA UAC bypass implementation of Stinger that obtains the token from an auto-elevated process, modifies it, and reuses it to execute as Administrator.
C++
205
star
6

OffensiveLua

Offensive Lua.
Lua
146
star
7

Artillery

CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administrator.
C
146
star
8

ColorDataProxyUACBypass

Exploits undocumented elevated COM interface ICMLuaUtil via process spoofing to edit registry then calls ColorDataProxy to trigger UAC bypass. Win 7 & up.
C
130
star
9

WMIProcessWatcher

A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
C++
113
star
10

tools

A collection of tools created for computer security research purposes.
Python
108
star
11

cve-2018-10933

cve-2018-10933 libssh authentication bypass
Dockerfile
107
star
12

backdoors

Tools for maintaining access to systems and proof-of-concept demonstrations.
Python
103
star
13

MsSettingsDelegateExecute

Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key.
C++
74
star
14

pyongyang_2407

Pyongyang 2407 - Android ROM from North Korea, modified to run on WBW5511_MAINBOARD_P2 devices. Releases contains an archived ROM with all needed tools to boot DPRK Android on compatible hardware. This repository contains installation instructions, hardware documentation and exploits for disabling censorship tools of North Korea Android.
C
66
star
15

envschtasksuacbypass

Bypass UAC elevation on Windows 8 (build 9600) & above.
C++
53
star
16

documents

Papers, presentations and documents from the team at Hacker House.
Perl
47
star
17

shellcode

shellcode are codes designed to be injected into the memory space of another process during exploitation.
C
42
star
18

electionhacking

Diebold Accuvote-TSx Election Machine Hacking
C++
34
star
19

NoFaxGiven

Code Execution & Persistence in NETWORK SERVICE FAX Service
C++
30
star
20

Gigabyte_ElevatePersist

Giga-byte Control Center (GCC) is a software package designed for improved user experience of Gigabyte hardware, often found in gaming and performance PC's. A UAC elevation vulnerability exists that can be used for persistence in a novel fashion.
C++
30
star
21

AESCrypt

AES-256 Microsoft Cryptography API Example Use.
C++
27
star
22

rebirth

rebirth IOS11 - 11.3.1 jailbreak security research utility
C
22
star
23

cve-2021-34527

CVE-2021-34527 AddPrinterDriverEx() Privilege Escalation
C++
18
star
24

hackerhouse-opensource

Github profile
11
star
25

hfioquake3_DoS

ioquake3 engine is vulnerable to a remotely exploitable off-by-one overflow due to a miscalculated array index within the privileged admin console command banaddr. Attacker needs the rcon password to exploit this vulnerability.
Python
5
star