Hello everybody and welcome back. And let's see what the security measure
would be for anyone to not be able to bypass the user account control on
Windows 10. So, in the previous video we saw that we are able to bypass and
gain the system administrator account on the Windows 10 host. But, let
me just show you once again. So if I just sessions, and then enter session ID
number two...and, whoops, once again forgot the session. So it is the session s
-i, and then I exit both of them, and then I also enter the third one, and exit
that one as well. So if I just type here sessions, we do
not have any connections anymore, which is good. So what we want to do is
basically repeat the process of exploit. So I will do this real fast. I will not
explain what I'm doing since I explained it in the previous videos. So use exploit/multi/handler,
show options. Everything is already preset, and I exploit -j -z,
and I run this right here. But before I actually run this, I want to set the
certain settings in Windows that enables us to actually ask for the
administrator password for all the important programs that you open on
Windows. For example, if you were to open task manager right now, it will not ask
for any administrator password or anything like that. It will basically
just open it and this is the most case in most Windows 10 machines, since they
do not have your own user account control to always notify when some
application tries to run a certain program. But if you go to the search bar
right here and type uac, which will lead you to the control panel change
user account control settings and you click on it, you will get this little
window which will give you four different options when to notify you
when apps try to make changes to computer. Which will notify you, for
example, once you open the registry keys, the the task manager,
basically any important application. So, as you can see by default on Windows 10
host it is set to don't notify me when I make changes to Windows settings. So, this
will be set by default on most Windows 10 PCs. In order to bypass, in
order to actually secure yourself from the bypass mechanism that we did in the
previous video, you want to set this to always notify. As we can see right here,
it says always notify me when apps try to install software or make changes to
my computer. Or always notify me when I make changes to Windows settings. So this
will also prompt us for the administrator password once we ask, once
we, for example, open task manager. So just like here okay, and enter your
administrator password. And if I just type your task manager once again, you
will see that right now it will ask me, do I want to allow this app to make
changes to the device? And I click here yes, and then it opens the task manager.
Now you might be asking, so what does task manager have anything to do with
this? Well, basically, the task manager doesn't have anything to do with this.
But, the always notify me option in the user account control prevents the system
privileges bypass in the Kali Linux fodhelper module. Or basically any
other module that you have for bypass in Windows 10. So if I show you right here,
let me just see if we have any sessions connected. So we do not have any sessions
connected. Let us double click this, we open the meterpreter session 4, and we
enter the session. So getuid, we can see that we are just a simple user. We
are not the system privilege admin. So what we want to do right now is use
exploit/window/bypass...
I'm not not really sure, let me just search bypass. Not really sure if it is a module
or exploit. Search bypass, and let's try to find the
same bypass module that we used. So, let's try this, search bypass_fodhelper...
Or it is not fodhelper, let me just find it right here.
Zoom out a little bit, and let us see where our bypass_fodhelper is. Okay,
so here it is. It was under local, I forgot to specify this. So it is underscore
helper. So we copy this right here, and then we zoom in so you can see it a
little bit better. Then use, and we paste the name of the exploit, which is the
same as in the previous video. And now if I clear the screen and just type your
show options, everything is already set. We just need to change the session ID,
since if I type your sessions, you will see that right now the current session
open is under ID 4. So we set session under 4, and we can try to
exploit it right now. As you can see in the previous video it worked, but right now
it will not work. As it says, exploit aborted due to failure: not vulnerable.
UAC is set to always notify me. This module does not bypass this setting,
exiting. And that's how you prevent the privilege escalation on your Windows 10
PC. Now it might be sometimes annoying when you need to open task manager every
time and click to allow this application to make changes, but it
can be useful once you do not want anyone to gain system privilege
escalation on your PC. So, that would be about it for preventing the privilege
escalation on Windows 10. What we will do in the next video is cover some of the
post modules post, exploitation modules that you can use on the target. So, that's
about it for this video. I hope I see you in the next one
and take care. Bye!