Skip to content

zha0gongz1/iscsicpl_bypassUAC

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

9 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day

The iscsicpl.exe binary is vulnerable to a DLL Search Order hijacking vulnerability when running 32bit Microsoft binary on a 64bit host via SysWOW64. The 32bit binary, will perform a search within user %Path% for the DLL iscsiexe.dll. This can be exploited using a Proxy DLL to execute code via "iscsicpl.exe" as autoelevate is enabled. This exploit has been tested against the following versions of Windows desktop:

  • Windows 11 Enterprise x64 (Version 10.0.22000.739).
  • Windows 8.1 Professional x64 (Version 6.3.9600).

Usage

iscsicpl_bypassUAC.exe "reg save hklm\sam C:\xx\sam.hive"

iscsicpl_bypassUAC.exe "C:\Windows\System32\cmd.exe"

These files are available under a Attribution-NonCommercial-NoDerivatives 4.0 International license.

About

UAC bypass for x64 Windows 7 - 11(无弹窗版)

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages

  • C++ 84.6%
  • C 15.4%