FodHelper UAC Bypass
This particular bypass was disclosed in 2017
and leverages the Fodhelper.exe application
that was introduced in Windows 10
to manage optional features like region-specific keyboard settings.
The Fodhelper binary runs as high integrity,
and as we will demonstrate,
it is vulnerable to exploitation
due to the way it interacts with the Windows Registry.
More specifically, it interacts with the current user’s registry,
which we are allowed to modify.
As reported in the original blog post,
Fodhelper tries to locate the following registry key,
which does not exist by default in Windows 10.
If we create the registry key and add the DelegateExecute value,
Fodhelper will search for the default value
and use the content of the value to create a new process.
If our exploit creates the registry path
and sets the Default value to an executable,
powershell.exe,
it will be spawned as a high integrity process when Fodhelper is started.
Let’s inspect a proof-of-concept in PowerShell
that creates the needed registry keys
with associated values required to launch PowerShell.
The first command creates the registry path
through the New-Item cmdlet and the -Path option.
Additionally, it sets the value of the default key to “powershell.exe”
through the -Value option,
while the -Force flag suppresses any warnings.
In the second command, the DelegateExecute value is created
through the similar New-ItemProperty cmdlet,
again using the -Path option along with the -Name option
to specify the value,
and the -PropertyType option to specify the type of value,
in this case a String.
Finally, fodhelper.exe is started
to launch the high-integrity PowerShell prompt.
Based on the output,
the PowerShell prompt is running in high integrity.
This is obviously only a simple proof-of-concept
but it has been weaponized by exploitation frameworks including Metasploit
so let’s test it out.
First, we’ll use one of our many shellcode runners
to obtain a reverse Meterpreter shell on the Windows 10 victim machine,
and use that active Meterpreter session to launch the fodhelper UAC bypass module.
First we choose the module,
display and set the 64-bit target option,
along with the session number,
and configure the payload.
If we view the desktop of the Windows 10 victim machine
when the exploit is launched,
we discover an alert from Windows Defender.
To get more information, we can open the Security Center app
from the search menu,
navigate to the Virus & threat protection submenu,
and click Threat history.
Under Quarantined threats, we find a new entry.
AMSI stops the default Metasploit fodhelper module from bypassing UAC
and even kills the existing Meterpreter session.
In the next section, we’ll attempt to execute the UAC bypass and evade AMSI.