Skip to content

FourCoreLabs/TrustedInstallerPOC

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

TrustedInstaller

A simple Proof of Concept in Go to spawn a new shell as TrustedInstaller. Read more about how this PoC works on this blog about TrustedInstaller. It is important to note that this should be executed as a user which has SeDebugPrivileges. Upon execution, it will automatically ask for UAC in case it is not executed as as an Administrator.

POC

  1. Clone the repository
$ git clone https://github.com/FourCoreLabs/TrustedInstallerPOC.git
  1. Ensure you have Go installed. This POC has been tested on Go 1.19.
  2. Either build the binary and execute it
$ go build ti
$ ./ti.exe
  1. Or run it directly
$ go run ti

This will spawn a new cmd shell with TrustedInstaller privileges which can be confirmed by running the command whoami /all

demo

API

  • RunAsTrustedInstaller
    • Use the RunAsTrustedInstaller function to pass any executable to be run with TrustedInstaller privileges.

Releases

No releases published

Packages

No packages published

Languages