2

Is it possible for a running process to turn off User Account Control (UAC) via a Windows API call? If so, which API calls are needed?

I found this interesting question/answer on stackoverflow, however, I'm interested if there is some other way to do it.

  • It seems what they're talking about is indeed voodoo, as installing a SYSTEM-level service requires UAC elevation anyway. – Polynomial Jan 20 '14 at 16:20
  • Offtopic-should be on Security EX – Stolas Jan 21 '14 at 7:28
  • 2
    @Stolas true the question is security related, however, I saw it more as reverse engineering the sequence of system events and calls that are involved in switching UAC off. For instance, this sequence could involve UI events and actions using the MS Windows UI Automation accessibility framework. I was also interested in an answer along the lines of using a zero-day like you pointed out. Thanks – Benny Jan 21 '14 at 7:58
3

This seems like a security ex question instead of one about reverse engineering. Therefore I'd keep my answer short.

This should not be possible. Simply as malware would abuse this, what you could do if you want this is find a 0day in kernel space and get SYSTEM privileges. Back in 2010 there was someone from China who has posted a method on the code project(if I recall correctly). It's now hosted on the exploit-db..

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/

Goodluck on your research.

Not the answer you're looking for? Browse other questions tagged or ask your own question.