Skip to content

C# implementation of the Fodhelper UAC bypass. As mentioned in s3cur3th1ssh1t's blogpost (https://s3cur3th1ssh1t.github.io/Signature_vs_Behaviour/) Defender does not like any .exe in the HKCU:\Software\Classes\ms-settings\Shell\Open\command(Default) entry. We don't need to specify .exe to execute a binary, but running unsigned executables is not…

Notifications You must be signed in to change notification settings

R-Secure/Fodhelper-UAC-Bypass

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 

Repository files navigation

Fodhelper-UAC-Bypass

C# implementation of the Fodhelper UAC bypass. As mentioned in s3cur3th1ssh1t's blogpost (https://s3cur3th1ssh1t.github.io/Signature_vs_Behaviour/) Defender does not like any .exe in the HKCU:\Software\Classes\ms-settings\Shell\Open\command(Default) entry.

We don't need to specify .exe to execute a binary, but running unsigned executables is not really good practice. We can copy rundll to a writable location and execute it from there.

Usage:

Fodhelper-UAC-Bypass.exe "C:\Windows\Temp\payload.dll,DllMain"

About

C# implementation of the Fodhelper UAC bypass. As mentioned in s3cur3th1ssh1t's blogpost (https://s3cur3th1ssh1t.github.io/Signature_vs_Behaviour/) Defender does not like any .exe in the HKCU:\Software\Classes\ms-settings\Shell\Open\command(Default) entry. We don't need to specify .exe to execute a binary, but running unsigned executables is not…

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published