QuickAssist_UAC_Bypass is a proof-of-concept demonstrating that Windows UIAccess binaries can be abused to load a DLL via the BrowserExecutableFolder policy, documented here for authorized red teams and defenders.
| Tool | R41N3RZUF477/QuickAssist_UAC_Bypass — PoC showing that any UIAccess bypass is effectively a full UAC bypass on Windows 10/11 clients |
| Category | Windows privilege escalation research / UAC bypass proof-of-concept, written in C |
| Primary Use | Demonstrating, in authorized engagements and lab environments, how the QuickAssist UIAccess binary plus the WebView2 BrowserExecutableFolder policy yields high-integrity code execution without any UAC prompt |
| Safe Use | Strictly for authorized penetration tests, red-team exercises on owned lab machines, and defensive research into UAC hardening and detection |
| Telemetry Note | Defenders can watch for QuickAssist.exe spawning with unusual parent processes, registry writes to the BrowserExecutableFolder WebView2 policy key, and DLL loads into the QuickAssist process from non-standard paths |
QuickAssist_UAC_Bypass is a compact C proof-of-concept from R41N3RZUF477 that abuses a structural weakness in how Windows treats UIAccess binaries, and its README is unusually candid about the theoretical point it exists to prove. The author's central claim is worth internalizing: any bypass that achieves UIAccess-level integrity should be regarded as a full UAC bypass, not a weaker cousin of the classic auto-elevate techniques. The repository, sitting at roughly 241 stars with active commits on the main branch, is a research artifact intended for authorized testing, and this writeup treats it purely as documentary analysis for professionals working on systems they are permitted to assess.
The target of the abuse is QuickAssist, the remote-assistance application introduced in Windows 10 1809 and installed by default on client SKUs. QuickAssist carries the uiAccess flag in its manifest, which is the mechanism Windows provides to accessibility and input tools so they can interact with elevated windows from a medium-integrity context. That design decision is exactly what makes the binary interesting to researchers: the operating system deliberately grants it a higher integrity level and suppresses the prompts an ordinary process would trigger. The README walks through why this trust assumption converts into an escalation primitive once an attacker can influence what code the process loads.
The loading mechanism is the clever part of the chain. Because QuickAssist renders its login mask with WebView2, it honors the BrowserExecutableFolder group policy that tells the WebView2 runtime where its binaries live. The PoC manipulates that policy so the runtime resolves its loader DLL from an arbitrary attacker-chosen location, and the DLL then executes inside the QuickAssist process. The README is explicit that the result is high integrity but not full administrator privileges, which at first looks like a downgrade compared to conventional auto-elevate UAC bypasses that hand over an elevated token directly.
What elevates the technique beyond a curiosity is the follow-on reasoning in the README. High integrity is sufficient to call SetWindowsHookExW() — which the author notes is compatible back to pre-Windows 10 1809 — or GetProcessHandleFromHwnd() to take over elevated processes that own a window in the current session. If no elevated window exists, the README observes that one can be created by triggering an elevated scheduled task, after which the same window-hijacking APIs apply. In other words, the missing administrator token is a solvable problem rather than a fundamental limitation, and the author argues this makes UIAccess-based bypasses strictly better than regular ones in one key respect: they never generate a prompt.
That prompt-free property is the headline defensive implication. The technique works even when UAC is set to Always Notify, the most paranoid configuration available to end users, because UIAccess programs are exempt from elevation dialogs by design. The README frames this as the PoC's real thesis: earlier UAC bypasses that could be rewritten to target a UIAccess binary instead of an auto-elevating one are thereby upgraded to always-notify-compatible bypasses. For defenders, this undermines the common assumption that aggressive UAC settings meaningfully raise the bar against a local attacker who already has code execution.
The compatibility envelope is well documented and narrow in ways that matter operationally. The technique works on Windows 10 1809 and later and on Windows 11, but only on client editions — Windows Server is out of scope because QuickAssist is not part of that payload. WebView2 version 87 or later must be present, which in practice means a reasonably current Microsoft Edge installation since WebView2 ships alongside Edge updates. On Windows 11, QuickAssist is technically an optional feature, though the README notes it is installed by default. The author also cross-references their other project, TabTip_UAC_Bypass, for scenarios requiring better compatibility such as server operating systems.
From an interface standpoint the tool is deliberately minimal: a single executable taking a path to a DLL as its argument, with the README showing the shape as QuickAssist_UAC_Bypass.exe [path_to_dll]. That is the entire user surface — the binary's job is only to set up the policy manipulation and process launch, not to provide payload functionality itself. We deliberately avoid walking through the offensive chain end to end; the value for readers is understanding the Windows internals at play, not an operational recipe. Anyone reproducing this should do so exclusively in an isolated lab or under a signed engagement scope.
For blue teams, the documentation suggests several concrete detection angles. Monitoring writes to the WebView2 BrowserExecutableFolder policy key in the registry is the most direct signal, since legitimate changes there are rare on typical endpoints. Process creation telemetry showing QuickAssist.exe launched by an unexpected parent, or loading modules from user-writable paths rather than the packaged application directory, is another high-signal pattern. Because the second stage hinges on window hijacking via SetWindowsHookExW() or GetProcessHandleFromHwnd(), API-level instrumentation in EDR products can also catch the transition from the DLL load to interaction with an elevated window.
As a research contribution, the repository's significance is less the specific QuickAssist abuse and more the generalized claim it substantiates: the UIAccess trust model is a standing exception to UAC's promise, and every component that inherits it inherits the same exposure. Hardening conversations that follow from this include whether QuickAssist should be removable by policy on sensitive endpoints, whether WebView2 policy keys deserve tamper monitoring, and whether the uiAccess manifest flag deserves broader scrutiny in threat modeling. For authorized professionals, QuickAssist_UAC_Bypass is a well-documented case study in how a single design decision — prompt-free elevated-integrity execution for accessibility binaries — ripples into an entire class of always-notify-resistant escalation techniques on modern Windows clients.
R41N3RZUF477/QuickAssist_UAC_Bypass.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.