UACME: UAC bypass via "ms-windows-store://" handler hijack & WSReset.exe trigger

Complete.

I’ve finished testing this method implementation. It works fine on 17763(+LTSC)/18362/18363/19041/19042/19043 and insider preview 213xx builds.

3.5.5 version of uacme will be released tomorrow. Thanks for sharing.

Also there is 3rd way which I think is good:

1. Enumerate `HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications`

2. Find value which data string contains `"WindowsStore"`

3. Open key `HKCU` + found data string + `\URLAssociations`

4. Enumerate values of this key until `ms-windows-store` name is found

5. Data of this key contains the correct `AppX...` name.

This one looks promising. Will try that method.

Ok I think I found a solution - create an empty REG_SZ named NoOpenWith under HKEY_CURRENT_USER\SOFTWARE\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2.

I’ll make standalone test application for this method and post it here.

How did you figure that out?

Well this service is responsible for handling all these fancy new appx crap. By default it is turned off on LTSC. Btw probably no elevation required to launch it.

Probably there is a better solution.

Having this AppXSvc running on LTSC 1809 version triggers exploit ms-windows-store through UserAssocSet exploit and does this immediately.

Edit:

HKEY_CURRENT_USER\SOFTWARE\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command

Will check this later on 19042.

I’ve noticed that sometimes it succeeds but cmd.exe is hidden and invisible. I think it’s because cmd inherits wsreset.exe’s console, but it exits really fast and cmd is left without a console. Might wanna change default program to cmd.exe /C start cmd.exe to really open it in a new console.

That’s already in uacme. There was another method for wsreset before and this behavior is known since then.

I will try to detect Ms Store state however I can’t use most of this fancy API because it brings a lot of unneeded dependencies.

As of “OpenWith” issue it need more tests as it always spawns for me at first run of exploit.

I will look into this issue and post results here as usual. And there will be uacme update because of new shell32 versions.

IMO it only worth if you are using this UserAssocSet somewhere in everyday use program, besides it still will have a switch as this interface has at least two variants with different IID. I will just remake existing signature lookup routines.

Thanks. I’ll look on it and later integrate this if everything goes well. No date yet.