Not a Security Boundary: Bypassing User Account Control

Presented at DerbyCon 7.0 Legacy (2017), Sept. 23, 2017, 5 p.m. (50 minutes)

Microsoft's User Account Control feature, introduced in Windows Vista, has been a topic of interest to many in the security community. Since UAC was designed to force user approval for administrative actions, attackers (and red teamers) encounter UAC on nearly every engagement. As a result, bypassing this control is a task that an actor often has to overcome, despite its lack of formal designation as a security boundary. This talk highlights what UAC is, previous work by others, research methodology, and details several technical UAC bypasses developed by the author. Matt Nelson (@enigma0x3) is a Red Teamer and Security Researcher with SpecterOps. Matt has a passion for offensive PowerShell, is an active developer on the PowerShell Empire project, and helps build offensive toolsets to facilitate red team engagements. He has published research on a number of novel UAC bypasses and holds CVE-2017-0007 for his device guard research. @enigma0x3

Presenters:

• Matt Nelson

Links:

• https://www.derbycon.com/saturday-schedule/#event-111
• https://infocon.org/cons/DerbyCon/DerbyCon 7 2017/Not a Security Boundary Bypassing User Account Control Matt Nelson.mp4

Similar Presentations:

• DerbyCon 8.0 Evolution (2018) / The Unintended Risks of Trusting Active Directory
• ekoparty 14 (2018) / Administrators Group: UAC Bypass in Windows 7 to… 10!
• DerbyCon 7.0 Legacy (2017) / An ACE in the Hole: Stealthy Host Persistence via Security Descriptors