uac | Live Response collection script for Incident Response | Cybersecurity library

I created a WPF Desktop Application as well as a Worker Service (all .NET 6.0 Preview 3), packed them in a .MSI Setup File using Microsoft Visual Studio Installer Projects extension, which installs the WPF Application on the machine.

While the application installs and functions correctly, I had to somehow implement the service installation which should run after the WPF Application would be installed. I created a function for that, which runs sc.exe as administrator and installs the service using Process.Start(), which looks like this:

I am trying to write a fuction that translates an mRNA sequence to a peptide sequence depending on the nucleotide from which we start counting codons (either the first nucleotide, the second or the third). I have a code for it, but when I print the three results (of the three peptides) I only get a sequence for the first peptide. The last two are blank. Any idea what the problem might be? And how could I return all three peptides by default?

Is it possible to enable /disable touchscreen trough hid (Human Interface Devices in "Control Panel\All Control Panel Items\Device Manager") with standard user right (without elevated-privileges / admin access-rights) ?
I'm programing an application in C#. If I don't start my application trough "run as" on Visual Studio, security is blocking access.

What are my alternatives with my current setup / limitation:

• Standard user (basic right)
• Admin account with password in a secure encrypted file.
• The standard user cannot grant permission trough UAC because he don't have right.
• Using this code to check if user have elevated/admin right: return new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);

1. Process with startInfo.Verb = "runas"; Standard user can't accept UAC to run a process that require admin privilege / elevated. Elevating process privilege programmatically?

2. App.manifest: Standard user can't accept UAC to run an app that require admin privilege / elevated. How do I force my .NET application to run as administrator?

Potential alternatives ?

1. ACL ???
2. App.manifest: with an install.msi from my "IT team packager with Zenwork or SCCM" to deploy it on computers user ?
3. Service that run as "local service" or "system" and an app to call methods of service with an install.msi from my "IT team packager with Zenwork or SCCM" to deploy it on computers user ?

Short disclaimer: As this question includes topics regarding hacking/pentesting, I'd like to state that this question is only asked for educational purposes as part of a school project. To prevent possible abuse, I will only post code that is necessary for understanding the problem.

To demonstrate dangers and vulnerabilities of Windows 10, I'm currently writing a small C++/WinAPI application that utilizes two common techniques:

• A UAC bypass using the "fodhelper technique" (this works by simply setting a specific registry value to the path of the executable which is supposed to be elevated and then launching an automatically elevated Windows executable called "fodhelper.exe", which will then read the registry value and execute it as command/launch the specified application).
• Performing PE injection, i.e. running a PE file from the address space of the current process (based on this example from github). The PE that gets injected in my program is a simple C++ Console Application (x86) that prints a message box. The shellcode is hardcoded in the injector binary (x86).

I managed to perform both of these techniques successfully in independent files. However, once I combine these two methods (i.e. first elevating, then injecting), a weird error appears.

When the injector gets started manually (by double clicking), everything works fine, but when the injector is launched by System32\fodhelper.exe (x64) as a result of the UAC bypass, the following happens: After the injection has finished, the console window of the injected application appears, but instead of continuing the execution, I receive a bunch of error messages stating "The code execution cannot proceed because [garbage characters].dll was not found". This indicates that something went wrong with the offsets, and the Windows loader is trying to read the imports at a wrong position.

To summarize: The code injection works fine, unless the injector was started by fodhelper.exe. In this case the injected PE file is unable to run.

• Debugging the injection using GetLastError and printing the various memory addresses used during the injection. There is no difference if the file is manually started (and the injection is successful) or if it gets started by fodhelper.exe (and the injection fails).
• Replace the WriteProcessMemory calls with WriteFile to compare the output file when the injector gets manually launched or by fodhelper.exe. Both output files are exactly the same and runnable. This indicates that the injection itself is not the problem, but the Windows loader seems to act differently.
• Manually elevating the injector using UAC or by using an elevated command prompt. In both cases, the injection is successful.
• Copying fodhelper.exe to another location (for example to the desktop) and launching this copy. In this case, the injection is successful. The injection only fails if the injector gets started by the original fodhelper.exe in the System32 folder.

It seems that the injection behaves completely identical, but the indicators show that due to some unknown impact of fodhelper.exe that gets passed down to the injector, the Windows loader seems to behave differently.

I appreciate any explanation or assumption! Feel free to ask if you require more information.

(with limited debug info and comments): https://0bin.net/paste/UPRIg12n#6nJvBok72UcDvIa56c-XEss7AibIh1Zrs+c3sUzvQMj

Note: See how the injection works if you exclude the elevateProcess function or manually elevate the exe with UAC, and how it fails when including said function.

According to the answer by user RbMm, this error is a result of a specific exploit protection attribute (PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY with the EnableModuleTamperingProtection value) that gets automatically applied onto fodhelper.exe and seemingly gets inherited by all child processes. According to this, removing/resetting this attribute when launching the target process should fix the error. So far I've tried the following, but couldn't achieve any change in the outcome:

Question: Can anyone explain to me how to call UAC? At this point, I need to elevate a Powershell session. All of the other methods I've used in the past or see here require a password. I need to bypass the password. Please see the write up under the following function for more information:

I am making a python app and compiled it using pyinstaller. There is no problem when the user installs the app only for himself/herself , but when he/she installs for all users, it gives a permission denied error.

It's basically a chatbot I made for a project. When the program is run the first time, it takes some basic data from the user and stores in a file. There's no problem when the program is installed for that user only,i.e., the program in stored in the user's appdata folder.

But when the user tries to install it for all users, i.e., the program is stored in the program files(x86) folder, it gives a permission error as the folder is system protected.

I tried to bypass it by adding the --uac-admin flag, but it is not convenient to go through the UAC prompt every time the user wants to run the program.

I wanted to know if there was a way to run the program as admin without the UAC prompt.

Any help would be highly appreciated!

I have a Windows 10 Enterprise VM running an Azure Devops Agent in Interactive mode. The agent runs using the only user the machine has, and it is an Administrator with UAC disabled. However, when executing tasks that require an elevated command prompt, as registering dlls, the command fails with the following error message:

I need to verify an .exe and ensure the publisher name matches the expected name (not based on a key since that can change as new code signing certificates are issued, the name is always the same).

I found samples of using WinVerifyTrust to verify a signed .exe, but I also need the "Verified Publisher" that the UAC shows for signed executables. How do I get that using the Windows API functions in c or c++ ?

TIA!!