One Day SecOne Day Sec

Study Notes of using sdclt.exe to bypass UAC

Onedaysec
3 min read
0 views
docx image 1770015589554 0 1c121b3fe3

0x00 Preface

---

Matt Nelson‏ @enigma0x3 recently published an article revealing a technique to bypass Win10 UAC by modifying registry key values under HKCU. The article links are as follows:

https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/

https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/

0x01 Introduction

---

This article will test it, share testing insights, and organize offensive and defensive techniques for this method.

0x02 Principle

---

Sigcheck

Can be used to view the manifest of exe files.

Download link:

https://technet.microsoft.com/en-us/sysinternals/bb897441.aspx

In the Win10 environment, run in cmd:

sigcheck.exe -m c:\windows\system32\sdclt.exe

As shown in the figure

0x02 Principle — technical illustration 1

level="requireAdministrator"

true indicates that privileges can be automatically elevated

In the Win7 environment, also use Sigcheck to view sdclt.exe

As shown in the figure

0x02 Principle — technical illustration 2

level="asInvoker" indicates that privileges will not be elevated, which is why Win7 is not supported

Next, use ProcessMonitor to monitor the startup process of sdclt.exe and check if it calls other programs

0x03 Actual Testing

---

Test environment: Win 10 x64

Note:

This method was only tested successfully on Windows 10

Enter in cmd:

sdclt.exe

Normal startup, as shown in the figure

0x03 Actual Testing — technical illustration 3

Use ProcessMonitor to view the startup process

As shown in the figure

0x03 Actual Testing — technical illustration 4

During the startup of sdclt.exe, it searches for the registry key HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe with High privileges

If the registry key is manually modified and parameters are filled in, UAC bypass can be achieved

The bypass method is as follows:

Create a new registry key:

HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe

And set the default value to cmd.exe

As shown in the figure

0x03 Actual Testing — technical illustration 5

Restart sdclt.exe and observe that it proceeds to execute cmd.exe, successfully bypassing UAC, as shown in the figure

0x03 Actual Testing — technical illustration 6

Note:

The launched exe cannot include parameters, otherwise it will fail

For example, entering C:\Windows\System32\cmd.exe /c calc.exe will not achieve exploitation

As shown in the figure

0x03 Actual Testing — technical illustration 7

In practical exploitation, if parameters need to be added, one can first write the parameters into a script and then load the script for exploitation

For better stealth and to achieve 'fileless' exploitation, try to find if sdclt.exe supports commands that accept parameters

Matt Nelson‏ @enigma0x3's second article addresses this issue, the article link is as follows:

https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/

Modify the registry to hijack the parameters passed to /kickoffelev, achieving 'fileless' exploitation

The specific method is as follows:

Create a new registry key value:

HKCU:\Software\Classes\exefile\shell\runas\command\

Create a new key named isolatedCommand of type REG_SZ, with content as startup parameters, which can be set to notepad.exe

As shown in the figure

0x03 Actual Testing — technical illustration 8

Then enter in cmd:

sdclt.exe /KickOffElev

Successfully executed the parameter, launching notepad.exe, as shown in the figure

0x03 Actual Testing — technical illustration 9

Replace the parameter with regedit.exe, the launch process is not intercepted by UAC, successfully bypassed

As shown in the figure

0x03 Actual Testing — technical illustration 10

However, creating the registry key exefile\shell\runas\command\ will affect the launch of other normal exe programs, so in exploitation, it is necessary to first create the key, execute sdclt.exe, and then delete the key

The entire process is implemented via PowerShell, the complete POC can be referred to:

https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-SDCLTBypass.ps1

0x04 Defense and Detection

---

Defense:

If UAC permissions are set to 'Always Notify', this method will fail

Detection:

Monitor registry key values:

HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe

HKCU:\Software\Classes\exefile\shell\runas\command\

Related Questions & Answers

What limitation does the first sdclt.exe bypass method have, and how is it overcome in the second method?

The first method (hijacking `App Paths\control.exe`) cannot pass command‑line arguments to the launched executable. For example, setting the value to `C:\Windows\System32\cmd.exe /c calc.exe` fails because sdclt.exe does not interpret the space as argument separation. The second method overcomes this by using the `-KickOffElev` switch and storing the full command in the `isolatedCommand` registry value under `exefile\shell\runas\command`. This allows arbitrary arguments, enabling fileless execution since the command can be embedded without writing a script to disk.

How can defenders detect or prevent this UAC bypass using sdclt.exe?

Setting UAC to 'Always Notify' will prompt for consent on every elevation, blocking this technique. Detection involves monitoring the creation of two registry keys: `HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe` and `HKCU:\Software\Classes\exefile\shell\runas\command\`. Security teams should alert on any modifications to these hive paths, especially by non‑administrative processes. Additionally, monitoring process creation chains that include sdclt.exe spawning unexpected children like cmd.exe or regedit.exe can indicate an attack.

What are the two different registry hijack methods demonstrated for bypassing UAC with sdclt.exe?

The first method sets the default value of `HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe` to the full path of an executable (e.g., cmd.exe), but it cannot include command‑line parameters. The second, fileless method creates a registry value `isolatedCommand` under `HKCU:\Software\Classes\exefile\shell\runas\command\` and then runs `sdclt.exe /KickOffElev` to execute the payload without writing a script to disk. Both methods are covered in detail in the [Study Notes of using sdclt.exe to bypass UAC](/news/study-notes-of-using-sdclt-exe-to-bypass-uac).

Why does this UAC bypass technique only work on Windows 10 and not on Windows 7?

The difference lies in the executable manifest of sdclt.exe. On Windows 10, sigcheck shows `level="requireAdministrator"`, meaning the process automatically requests elevation. On Windows 7, sdclt.exe has `level="asInvoker"`, so it runs with the same integrity level as the parent process and cannot be used for privilege escalation. This was verified using the Sysinternals tool sigcheck as detailed in the article.

What is the key principle behind using sdclt.exe to bypass UAC in Windows 10?

The technique exploits the fact that sdclt.exe runs with elevated privileges because its manifest specifies `requireAdministrator`. During startup, sdclt.exe searches the registry under `HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe` and can be hijacked by creating that key with a malicious executable as the default value. This allows an attacker to launch a payload with high integrity without triggering a UAC prompt. For more details, see the [Study Notes of using sdclt.exe to bypass UAC](/news/study-notes-of-using-sdclt-exe-to-bypass-uac).

Continue Reading