Examples of bypassing UAC

In the DLL side-loading example section in Chapter 5, we briefly introduced the DLL side-loading technique, which allows us to hijack the execution process by simply dropping a DLL module into the same directory as the program. You must have guessed, if we could find a vulnerable high-privilege system program that could drop a malicious DLL module into the same directory, wouldn’t that allow the privilege-elevated program to automatically mount our DLL file, allowing us to act maliciously as a privilege-elevated process?

In practice, it is not that easy. As mentioned earlier, basically, the system programs that can be automatically privileged in the complete UAC authentication process must be located in C:\Windows\System32 or C:\Windows\SysWOW64. These two system directories are the directories where files cannot be written without privileging. However, if we don’t have high-privilege write access, is it possible to borrow from a high-privilege...