UAC-A-Mola - Tool That Allows Security Researchers to Investigate New UAC Bypasses, In Addition To Detecting and Exploiting Known Bypasses

UAC-A-Mola is a tool that allows security researchers to investigate new UAC bypasses, in addition to detecting and exploiting known bypasses. UAC-A-mola has modules to carry out the protection and mitigation of UAC bypasses.

The strong point of uac-a-mola is that it was created so that other researchers can carry out the work and process of discovering new weaknesses in the UAC. Of course, the tool can be used in pentesting processes, as well as by IT teams to protect and enumerate equipment with UAC bypasses.

Installation

1. Download and install python 2.7.x for Windows taking into account your particular infrastructure, you can find the binaries here: https://www.python.org/downloads/
2. Add the python path to the path environment variable. You can do this by carrying out the following steps:
   1. Right click to my computer and left click to properties
   2. Left click to Advance system configuration
   3. Left click to Environment Variables
   4. In the system variables box, double left click to Path
   5. Left clicking into New add the following paths:
      • C:\Python27\
      • C:\Python27\scripts\
3. Download uac-a-mola tool from github by downloading the .zip file or by cloning the repo.
4. Open the folder uac-a-mola-master with a cmd and execute the following command:
   pip install -r requirements.txt
   Uac-a-mola is now ready to rock! You can test its functionality by typing:
   cd uacamola
python uacamola.py

Tutorial

This is a brief section that explains the use of some of the uac-a-mola modules:

Attack modules

Using the attack modules is something very simple that hardly requires explanation. The only thing you have to do is load the corresponding module in the framework using the load command, you can see the options or input parameters using the show command, with the run command the module is executed:

And other example:

Mitigate modules

Using the mitigation methods is also quite simple, but they have a slightly more complex internal structure that will be explained in this section. In relation to its use, the first thing that must be done is to load the available mitigation module:

In this case, we will need to set a password that the agents will use to comunicate with the listener that will be executed in uacamola framework. We can find the agents in the path uacamola/support/agents, opening that files we can see the password:

uacamola will be the password used for authentication and comunication, but we can change it. The other parameter required is a path to a file that contains a list of binaries to monitor, this binaries must have an agent.pyw file in the agents paths.

Just filling these fields and executing the run command, uacamola will start monitoring all the activity related to UAC bypass in the binaries that appear in the list. If dangerous activity is detected, it will automatically prune the dangerous branch (of the file system or registry) and it will execute the binary in a secure way. For exiting this mode we just need to press de ENTER key.

Download the tool: https://github.com/ElevenPaths/uac-a-mola