HEY EVERYBODY WELCOME TO THE going a little deeper part one.
So this is a 11 part series where we go a little bit deeper into the Windows operating systems are going
to be talking about a little bit more advanced topics and we're going to drill down a little bit further
than we spoke about.
Already a lot of this information and knowing how operating systems work.
Windows and or Linux work under the hood is important for a red team or because they're able to use
that information to leverage things to work in different ways than intended so for this particular one
we're going to start off with UAC.
So what is UAC.
It is called User Account Control.
It provides a temporary administrative rights to a process during the single time that it's being ran.
So this helps mitigate viruses malware people doing something they shouldn't.
And most of you if you ran a Windows system that you bought in the last four or five years you might
have seen this already.
So this is what it looks like it's normally the pop up box that when you try to run something it says
Are you sure you wanna do this.
That is a UAC.
And there's also a password prompt that asks for the local user administrator's password if if the current
user does not have admin rights.
So a standard user logged in running something as if they're part of the administrative group then they
will get a normal prompt.
What we're seeing here.
So if you if you are part of a standard user group but you're not an administrator and you try to run
it it will prompt you at the same one but just below the yes or no.
You're going to be prompted for the password so how does this work.
So don't be too worried about the chart here.
So right here is we have the user open the application.
So this is you running said application it executes something called a shell execute which is a API
call in windows under the hood which we have a module on API calls to understand what they are how they
work et cetera and that shall exact process calls the create process which is essentially creating the
process again we have a module on processes but a process of a process as a single application that's
running.
So it's going to create the process for it next.
It sends the process information to the application Info Service.
This is a service ran inside of Windows for UAC so it checks of active Xs installed Active X is a framework
built by Microsoft that allows it to do different things normally web based.
But this is mainly looked at to make sure that it is secure.
Desktop can be used so secure desktop is when the UAC prompt pops up and it stops everything else and
it blacks out the back of the screen.
So all you see is the prompt.
It's done this way so people manipulating a process can't just move the mouse cursor around or tab over
and hit enter from the process level it makes sure that the user has to physically move the mouse over
and click the button.
So if Active X is installed we go to secure desktop.
The person has the permissions they put it they click yes they have the right password it goes under
and runs the executable with higher rates.
So that's the administrator could be a different user and entirely depends on how it's been set up.
Now if Active X if secure desktop is not enabled we slipped back to the UAC slider which will go over
in a second and if Active X is not installed at all You'll go immediately to the UAC slider so the UAC
slider has a few levels it's either it's low medium or high.
Now if there is no UAC slider enabled.
So it's been us he's being completely disabled it'll go straight to Running executable with higher rights.
I'm sorry it won't run to explode higher rates.
It wouldn't go through this process so it wouldn't even bother to withdraw it.
However since it's enabled UAC sliders there if it's a medium level it will check to see if the application
is signed and approved by Microsoft if it is you know run the executable if it's low it doesn't care.
It just runs the executable as long as you press the button.
And if the US slider is on the high level it's required to have secure desktop.
So it kicks back to check if remote if secure desktop is enabled.
If it's not then the application will fail to run so you feel free to take a look at the chart pause
it if you need it.
It's a little bit of information now this isn't the full chart.
This can be scaled down even more to the point where there's individual process calls and everything
like that.
But I'm giving you the general higher gist of how UAC works at the system level.
So when an admin is an admin the same as a user when it yes and no.
So when a standard user logs in there provided something called a standard access token which again
we have a we have a whole video on tokens in this module.
It will be used for their session.
So a user does not need to throw a password around.
They get an access token assigned to them.
And that is passed around to different processes when things run.
So when you ran an application it passes the token with that and then that is indeed that is how it
determines what what privileges you're allowed to use or allowed to have.
So administrators are provided the same standard access token for their user but they are also assigned
a full administrative access token.
So this is the one that if a an administrative process needs to occur it checks to see if there's a
full administrator access token available for the user.
If there is then it goes it goes ahead and lets it uses the full admission to access token instead of
the standard user.
So it bypasses that extra bit of checking just keep that in the back your head will go over tokens and
a little bit more detail in a future video.
So we're going to do a quick look at the UAC slider and where it's at in case.
So this is a quick quick preview of what ought to be doing about the tokens but we'll ignore that for
now.
So here's our UAC slider and a good way to get to this UHC slider is to right click on this it run and
then you're going to take what's on the screen so it's User
Account Control settings.
And we'll get here right.
So this isn't off it's completely off.
Then we have our low setting which just says to notify me.
Nothing.
Nothing important here.
Then we have the medium.
So we want to notify me.
But it's also going to check for if the application is signed and then we have high which is the highest
level that it has to have secure desktop enabled.
So this is a quick quick overview of UAC.
Now there are ways that we're going to talk about in the exploitation and post exploitation modules
where we will be looking at how to bypass UAC because it can be it's good enough if an account has admin
access but if UAC is enabled and you try to run an admin based application from the command line so
let's say you have a shell on the machine it will pop with the UAC prompt to the user actually on the
screen for them but for you it's just going to.
It's just going to look like it's hanging there.
It's not doing anything.
So there are ways with registry keys as an example you can disable UAC entirely.
This is something we'll go over later but this has just been a quick quick deep dive into us seeing
kind of how it works.
I will put a link above the video that has a bit more details to the Microsoft documentation page around
UAC so you can dive a little bit more into detail and see a much fuller chart there.