{"id":8882,"date":"2021-08-11T02:41:00","date_gmt":"2021-08-11T00:41:00","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8882"},"modified":"2022-06-11T02:58:47","modified_gmt":"2022-06-11T00:58:47","slug":"utilizing-a-common-windows-binary-to-escalate-to-system-privileges","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/governance-risk-and-compliance\/utilizing-a-common-windows-binary-to-escalate-to-system-privileges\/","title":{"rendered":"Utilizing a Common Windows Binary to Escalate to System Privileges"},"content":{"rendered":"
\n
\"\"
Windows pwnage courtesy of trusted Windows binaries<\/figcaption><\/figure>\n<\/div>\n\n\n

Introduction<\/h1>\n\n\n\n

If you\u2019ve ever tried to run a command prompt as administrator on your Windows OS before, you\u2019ve seen a harmless popup appear. This is Windows User Account Control, or UAC. According to Microsoft, UAC \u201cis a fundamental component of Microsoft\u2019s overall security vision. UAC helps mitigate the impact of malware.\u201d (How User Account Control Works<\/a>)<\/p>\n\n\n\n

This article will show you how that isn\u2019t necessarily the case. While perusing random articles last night I found one referring to Fodhelper, which was found to be exploitable in 2017, and then again being used by the Trickbot malware in January 2020. Most intriguing though was discovering that Fodhelper is still exploitable. And not only exploitable, but it also bypasses Windows Defender with the desired command execution. Here\u2019s how.<\/p>\n\n\n\n

Fodhelper<\/h1>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Fodhelper is a trusted binary in Windows operating systems, which allows elevation without requiring a UAC prompt with most UAC settings. You can even try this yourself \u2014 go to the Windows search bar, search fodhelper, click run as administrator, and notice that there is no UAC notification. You\u2019re simply presented with the \u201cOptional features\u201d window in Windows. There isn\u2019t a ton of information available for Fodhelper, but the binary checks a specific registry key, and for whatever legitimate reason, executes any instructions included.<\/p>\n\n\n\n

For exploitation purposes, we can create a new key in the current user hive, add the DelegateExecute property to the key, followed by a custom value to execute.<\/p>\n\n\n\n