Circumventing UAC

In this section, we demonstrate one of the more intriguing UAC bypass techniques: modifying the registry via fodhelper.exe.

By modifying a registry key, the execution flow of a privileged program is ultimately redirected to a controlled command. Common occurrences of key-value misuses frequently involve the manipulation of the windir and systemroot environment variables, as well as shell open commands that target particular file extensions, depending on the program that is targeted:

• HKCU\\Software\\Classes\<targeted_extension>\\shell\\open\command (Default or DelegateExecute values) on the target system
• HKCU\\Environment\\windir
• HKCU\\Environment\\systemroot

fodhelper.exe

The introduction of fodhelper.exe in the Windows 10 operating system aimed to facilitate the management of optional features, such as region-specific keyboard settings. The location of the subject is as follows: the C:\\Windows\System32\fodhelper.exe file path corresponds...