/EventViewer-Unsafe-Deserialization-UACBypass

A uacbypass that works on medium IL that abuses EventViewers unsafe deserialization to RecentViews

Primary LanguageC#

EventViewer-Unsafe-Deserialization-UACBypass

A Proof of Concept (PoC) demonstrating a User Account Control (UAC) bypass technique in Windows by exploiting the unsafe deserialization of Event Viewer's RecentFiles. This technique was discovered by orange_8361.

Installation

This project is a Visual Studio Code project and requires Visual Studio and C# to be installed.

Usage

  1. Go to the "Releases" section of this repository.
  2. Download the latest release of "EventViewerDeserializationExploit.exe."
  3. Open a command prompt or PowerShell.
  4. Run the exploit executable with the desired command, like: EventViewerDeserializationExploit.exe cmd.exe

Credits

Credits to orange_8361 for discovering and sharing this UAC bypass technique.