wh0amitz / krbuacbypass Goto Github PK

I can't install the .exe file can you help please @wh0amitz

I built the .exe executable from your C# project and when I run it I get this error in step2.

Even though I went into the release section and loaded the exe file you just sent but the result is still the same. Can you help me?

Hi,

nice work, thanks for this. Are your aware if other Win32 APIs exists that can be modified in the same way as Win32 SCM APIs to always use Kerberos instead of NTLM for local auth?

Thanks

In my setup the krbscm action will not lead to a system shell. I am getting SCM opening error 1722

[*] Using ticket to connect to Service Manger
[*] AcquireCredentialsHandleHook called for package N
[*] Changing to Kerberos package
[*] AcquireCredentialsHandleHook called for package N
[*] Changing to Kerberos package
[*] InitializeSecurityContextHook called for target R
[*] InitializeSecurityContext status = 0x00090312
[-] Error opening SCM: 1722

asktgs works, the ticket with correct SPN exists in the cache and the target user is a local admin. When observing the RPC call to 127.0.0.1 I can recognize that the rpc bind call is not successful. Response is bind_nak Reject reason is 0x09 (invalid_checksum) which according to MS doc means This rejection code is used when an unrecoverable error is detected by the underlying security package.

Any idea which (hardening) configuration might be responsible for this behaviour? Afaik there exists no concrete guidance how to prevent the UAC bypass.

Otherwise how I can further debug the issue?

Thanks.

After the project is packaged, there is a problem in the compile process. According to the online method, choosing x64 does not solve the problem。

Hi,

Thank you for this tool!

During my first test I ran into the below error. Is there anything I can do different to get this to work?