README

:computer: UAC Bypass

</br>

</br>

User Account Control (UAC) is a mandatory access control enforcement feature introduced with Microsoft's Windows Vista and Windows Server 2008 operating systems, with a more relaxed[2] version also present in the versions after Vista, being Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows 11. It aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorises an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges and malware are kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorises it.

</br>

</br> </br>

UAC uses Mandatory Integrity Control to isolate running processes with different privileges. To reduce the possibility of lower-privilege applications communicating with higher-privilege ones, another new technology, User Interface Privilege Isolation, is used in conjunction with User Account Control to isolate these processes from each other. One prominent use of this is Internet Explorer 7's "Protected Mode".

Operating systems on mainframes and on servers have differentiated between superusers and userland for decades. This had an obvious security component, but also an administrative component, in that it prevented users from accidentally changing system settings.

</br>

:wrench: Functions:

• User UAC (EnableLUA)
  • UAC (User Account Control) settings in Windows are primarily controlled via the following registry key:
  • RegKey : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

</br>

• Administrator UAC behavior
  • When an administrator account triggers the User Account Control (UAC) Admin Approval Mode, Windows silently strips administrative rights and runs the process as a standard user. If an app requests full system access, UAC halts execution and displays a prompt requiring the admin to explicitly approve the elevation of privileges.
  • RegKey : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

</br>

• FilterAdministratorToken
  • The FilterAdministratorToken registry key controls how Windows manages permissions for the built-in, default Administrator account. Setting it to 1 enables UAC (User Account Control) for this account, requiring you to approve administrative actions. Setting it to 0 (default) disables UAC, granting full, unrestricted rights at all times.

</br>

• ConsentPromptBehaviorUser
  • The ConsentPromptBehaviorUser registry key dictates how Windows handles administrative permission requests for Standard Users.

</br>

• EnableInstallerDetection
  • The EnableInstallerDetection registry entry controls the automatic detection of installers in Windows. When this feature is enabled, the system looks for keywords such as "Install" or "Setup" in file names and automatically requests the administrator privileges required for installation upon execution.

</br>

• ValidateAdminCodeSignatures
  • The ValidateAdminCodeSignatures registry key controls how Windows handles security for programs that need special admin rights. Setting it to 1 forces Windows to only run programs with admin rights if their security signature is officially validated. Setting it to 0 turns this security check off.

</br>

• EnableSecureUIAPaths
  • The EnableSecureUIAPaths registry key is a core User Account Control (UAC) policy that restricts how specialized apps request system privileges.

</br>

• EnableUIADesktopToggle
  • The EnableUIADesktopToggle is a Windows Registry setting that controls how User Account Control (UAC) prompts behave. Specifically, it dictates whether certain accessibility programs (like Remote Assistance) can bypass the darkened "Secure Desktop" to display permission prompts directly on your normal screen.

</br>

• PromptOnSecureDesktop
  • PromptOnSecureDesktop is a Windows Registry setting that controls how the User Account Control (UAC) displays prompts for administrative changes. When activated, it locks and dims your screen, forcing you to answer an elevation request before doing anything else. This prevents rogue programs from clicking the prompt for you.

</br>

• EnableVirtualization
  • The EnableVirtualization registry key manages UAC (User Account Control) virtualization in Windows. It redirects legacy app attempts to write to protected system directories or registry keys into user-specific locations. By default, it is Enabled (1) to prevent older apps from crashing.

</br>

User Account Control settings list : Microsoft

</br>

Registry privileges:

Windows registry privileges control access to creating, reading, and modifying registry keys. Standard users can read most keys and write to HKEY_CURRENT_USER, but modifying system-wide settings in HKEY_LOCAL_MACHINE requires administrator privileges and elevated execution permissions.

Grant these permissions to the program.

:speech_balloon: Code example

{ a complete, ready-to-use method that retrieves all privileges of the
  current process and writes them—along with their current status
  (enabled, disabled, or enabled by default)—into a list of strings. }
function SetTokenPrivilege(const APrivilege: string; const AEnable: Boolean): Boolean;
var
  LToken: THandle;
  LTokenPriv: TOKEN_PRIVILEGES;
  LPrevTokenPriv: TOKEN_PRIVILEGES;
  LLength: Cardinal;
  LErrval: Cardinal;
begin
  Result := False;
  if OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, LToken) then
  try
    // Get the locally unique identifier (LUID) .
    if LookupPrivilegeValue(nil, PChar(APrivilege), LTokenPriv.Privileges[0].Luid) then
    begin
      // one privilege to set
      LTokenPriv.PrivilegeCount := 1;
      case AEnable of
        True: LTokenPriv.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
        False: LTokenPriv.Privileges[0].Attributes := 0;
      end;
      LPrevTokenPriv := LTokenPriv;
      // Enable or disable the privilege
      Result := AdjustTokenPrivileges(LToken, False, LTokenPriv, SizeOf(LPrevTokenPriv), LPrevTokenPriv, LLength);
    end;
  finally
    CloseHandle(LToken);
  end;
end;

</br>

Admin execute:

Running a program with administrator privileges
In addition, the program includes two different resources.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="MyAppAssemblyNameHere" type="win32"/>
  <description>My App Description</description>
  <!-- uncomment this to enable ComCtl v6 Visual Styles...
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
    </dependentAssembly>
  </dependency>
  -->
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Requesting elevation:

A program can request elevation in a number of different ways. One way for program developers is to add a requestedPrivileges section to an XML document, known as the manifest, that is then embedded into the application. A manifest can specify dependencies, visual styles, and now the appropriate security context:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="highestAvailable" />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Setting the level attribute for requestedExecutionLevel to "asInvoker" will make the application run with the token that started it, "highestAvailable" will present a UAC prompt for administrators and run with the usual reduced privileges for standard users, and "requireAdministrator" will require elevation. In both highestAvailable and requireAdministrator modes, failure to provide confirmation results in the program not being launched.

</br>

Jump to Registry Key:

To jump directly to a specific registry key, copy the full path and paste it into the address bar located directly below the menu bar in the Registry Editor (regedit). Alternatively, use the following code...

:speech_balloon: Code example

{ In Delphi, you can force the Windows Registry Editor (regedit.exe)
  to automatically jump directly to a specific registry key by modifying
  the LastKey value inside the Regedit applet registry before launching it. }
procedure TForm1.JumpToKey(Key: string);
var
  i, n: Integer;
  hWin: HWND;
  ExecInfo: ShellExecuteInfoA;
begin
  hWin := FindWindowA(PAnsiChar('RegEdit_RegEdit'), nil);
  if hWin = 0 then
  {if Regedit doesn't run then we launch it}
  begin
    // transmit information
    FillChar(ExecInfo, 60, #0);
    with ExecInfo do
    begin
      cbSize := 60;
      { informs the Windows operating system that the process handle of
        the launched application should be kept open in the hProcess field
        of the TShellExecuteInfo structure. }
      fMask  := SEE_MASK_NOCLOSEPROCESS;
      lpVerb := PAnsiChar('open');
      lpFile := PAnsiChar('regedit.exe');
      nShow  := 1;
    end;

    // execute process
    ShellExecuteExA(@ExecInfo);

    { pauses the execution of the current thread until a newly started
      process has completed its initialization }
    WaitForInputIdle(ExecInfo.hProcess, 200);
    hWin := FindWindowA(PAnsiChar('RegEdit_RegEdit'), nil);
  end;

  // show the windows regitsry
  ShowWindow(hWin, SW_SHOWNORMAL);
  // find the registry gui
  hWin := FindWindowExA(hWin, 0, PAnsiChar('SysTreeView32'), nil);
  // set windows registry top
  SetForegroundWindow(hWin);
  i := 30;

  repeat
    // simulate on key down
    SendMessageA(hWin, WM_KEYDOWN, VK_LEFT, 0);
    Dec(i);
  until i = 0;

  // the waiting time (ms) for switching the path in the registry (can be changed)
  Sleep(150);
  SendMessageA(hWin, WM_KEYDOWN, VK_RIGHT, 0);
  Sleep(150);
  i := 1;
  n := Length(Key);
  repeat
    if Key[i] = '\' then
    begin
      SendMessageA(hWin, WM_KEYDOWN, VK_RIGHT, 0);
      Sleep(150);
    end
    else
      SendMessageA(hWin, WM_CHAR, Integer(Key[i]), 0);
    i := i + 1;
  until i = n;
end;

Manual disable UAC:

To manually disable User Account Control (UAC) on Windows, open the Start menu, search for UAC, and select Change User Account Control settings. Drag the slider down to Never notify and click OK. Restart your PC to apply the changes.

If you need to completely disable UAC deep in the system, you can edit the Windows Registry:

• Press Win + R, type regedit, and hit Enter.
• Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.Locate
• Locate the EnableLUA value on the right side and double-click it.
• Change the value data to 0 and click OK.
• Restart your computer.