44# Module by @Defte_
55# Enables UAC (prevent non RID500 account to get high priv token remotely)
66# Disables UAC (allow non RID500 account to get high priv token remotely)
7+
8+
79class NXCModule :
810 name = "remote-uac"
911 description = "Enable or disable remote UAC"
@@ -17,14 +19,14 @@ def __init__(self, context=None, module_options=None):
1719 self .action = None
1820
1921 def options (self , context , module_options ):
20-
22+
2123 if "ACTION" not in module_options :
2224 context .log .fail ("ACTION option not specified!" )
23- exit ( 1 )
25+ return
2426
2527 if module_options ["ACTION" ].lower () not in ["enable" , "disable" ]:
2628 context .log .fail ("ACTION must be either enable, disable or query" )
27- exit ( 1 )
29+ return
2830 self .action = module_options ["ACTION" ].lower ()
2931
3032 def on_admin_login (self , context , connection ):
@@ -35,47 +37,24 @@ def on_admin_login(self, context, connection):
3537 ans = rrp .hOpenLocalMachine (remoteOps ._RemoteOperations__rrp )
3638 regHandle = ans ["phKey" ]
3739
38- keyHandle = rrp .hBaseRegOpenKey (
39- remoteOps ._RemoteOperations__rrp ,
40- regHandle ,
41- "SOFTWARE\\ Microsoft\\ Windows\\ CurrentVersion\\ Policies\\ System"
42- )["phkResult" ]
40+ keyHandle = rrp .hBaseRegOpenKey (remoteOps ._RemoteOperations__rrp , regHandle , "SOFTWARE\\ Microsoft\\ Windows\\ CurrentVersion\\ Policies\\ System" )["phkResult" ]
4341
4442 # Checks if the key already exists or not
4543 try :
46- rrp .hBaseRegQueryValue (
47- remoteOps ._RemoteOperations__rrp ,
48- keyHandle ,
49- "LocalAccountTokenFilterPolicy\x00 "
50- )
44+ rrp .hBaseRegQueryValue (remoteOps ._RemoteOperations__rrp , keyHandle , "LocalAccountTokenFilterPolicy\x00 " )
5145 except Exception as e :
5246 if "ERROR_FILE_NOT_FOUND" in str (e ):
53- context .log .debug ("here" )
54- ans = rrp .hBaseRegCreateKey (
55- remoteOps ._RemoteOperations__rrp ,
56- keyHandle ,
57- "LocalAccountTokenFilterPolicy\x00 " )
47+ context .log .debug ("Registry key 'LocalAccountTokenFilterPolicy' does not exist, creating it" )
48+ ans = rrp .hBaseRegCreateKey (remoteOps ._RemoteOperations__rrp , keyHandle , "LocalAccountTokenFilterPolicy\x00 " )
5849
5950 # Disable remote UAC
6051 if self .action == "disable" :
61- rrp .hBaseRegSetValue (
62- remoteOps ._RemoteOperations__rrp ,
63- keyHandle ,
64- "LocalAccountTokenFilterPolicy\x00 " ,
65- rrp .REG_DWORD ,
66- 1
67- )
52+ rrp .hBaseRegSetValue (remoteOps ._RemoteOperations__rrp , keyHandle , "LocalAccountTokenFilterPolicy\x00 " , rrp .REG_DWORD , 1 )
6853 context .log .highlight ("Remote UAC disabled" )
69-
54+
7055 # Enable remote UAC
7156 if self .action == "enable" :
72- rrp .hBaseRegSetValue (
73- remoteOps ._RemoteOperations__rrp ,
74- keyHandle ,
75- "LocalAccountTokenFilterPolicy\x00 " ,
76- rrp .REG_DWORD ,
77- 0
78- )
57+ rrp .hBaseRegSetValue (remoteOps ._RemoteOperations__rrp , keyHandle , "LocalAccountTokenFilterPolicy\x00 " , rrp .REG_DWORD , 0 )
7958 context .log .highlight ("Remote UAC enabled" )
8059
8160 except Exception as e :
0 commit comments