daxcess/uac-bypass-uiaccess

This project is a security research tool written in Rust that documents and demonstrates a specific way to bypass Windows User Account Control, commonly known as UAC, the popup that asks for permission before a program can make system level changes. The technique is aimed at security researchers studying how Windows handles elevated permissions, not general users. The README explains that Windows has a quirk in how it loads executable files into memory. When a program is loaded, Windows maps a copy of the file into memory through the operating system kernel. If a second copy of the same file is later loaded, Windows sometimes reuses the memory copy it already made instead of reading the file from disk again. The tool takes advantage of this by first loading a program into memory, then changing what is actually stored on disk, so that the version running in memory no longer matches the version sitting on the disk. Windows security checks, including the ones UAC relies on, can end up trusting the original, unmodified version while a different program actually runs. Specifically, the technique uses this mismatch to gain a Windows permission called UIAccess, which lets a program interact with higher privileged applications running under the same Windows user account. To pull this off, the tool needs to place its files in a folder that Windows treats as trusted and writable, and the README names a couple of Windows system folders that fit this description on typical machines. From there, it uses a Windows Task Scheduler trick combined with a technique called SetWindowsHookEx, which lets one program observe or react to events in another, to get an elevated command prompt to appear even when UAC is set to its strictest warning setting. The README is a detailed technical writeup explaining exactly how each step of this exploit works, aimed at people who already understand Windows internals such as process memory mapping and privilege levels. No license information is present in the README.