Improving Fodhelper
We know that the Fodhelper UAC bypass works
and we also know that the Metasploit module triggers AMSI,
so we must improve our tradecraft and develop a UAC bypass
that also evades AMSI.
Registry key names are limited to 255 characters,
registry value names are limited to 16383 characters,
and the value itself is only limited by the available system memory.
This means the registry value can contain both an AMSI bypass
and our PowerShell shellcode runner.
To avoid leaving behind such a large registry key,
we can simply opt for a PowerShell download cradle instead.
First, we’ll modify the shellcode runner located in run.txt
on our Kali web server to include one of the AMSI bypasses.
Then we’ll set up a Metasploit listener to catch the shell.
Once that’s completed,
we’ll modify the UAC bypass PowerShell commands.
After launching fodhelper.exe,
The Meterpreter session opens and then hangs.
Security Center on the Windows 10 victim machine
has generated a new antivirus alert.
The Meterpreter payload has been flagged
after the second stage payload has been sent.
In this case, Windows Defender monitored the network interface
and subsequently detected the unencrypted and unencoded second stage.
We could avoid this by enabling the advanced EnableStageEncoding option
along with StageEncoder in Metasploit.
We’ll set EnableStageEncoding to “true”,
and StageEncoder to a compatible encoder,
in this case x64/zutto_dekiru.
This time, we bypassed both AMSI and Windows Defender
and spawned our reverse Meterpreter shell at a high integrity level.
We could improve the UAC bypass by hiding
the PowerShell window and cleaning up the registry,
but this is unnecessary for the purposes of our case study.