auditing-windows-uac-and-integrity-boundaries

Auditing Windows UAC and integrity boundaries: when elevation happens without a real prompt

Windows separates code that runs elevated from code that does not, marks processes with an integrity level, and asks the user to consent before a process gains administrative rights. That boundary holds only when crossing it requires either a genuine consent prompt or an existing high-integrity context. It breaks when an auto-elevating binary, one the system elevates without prompting, can be steered by a medium-integrity process into loading an input the attacker controls, when an already-elevated process consumes a file, registry value, or path a non-administrator can write, when the elevation policy is broad enough to elevate more than it should, or when an integrity level is set but does not actually gate the operation it is meant to protect. In each case a medium-integrity foothold reaches a high-integrity context without the consent the boundary promised. The bug is elevation without genuine consent. You audit these by finding every way a non-elevated process influences what an elevated one does.

When to use

• A host has auto-elevating binaries or an elevation policy and you can enumerate what they consume.
• An elevated process reads a file, registry value, or path that a non-administrator may write.
• An integrity level is relied on to gate an operation you can test from a medium-integrity context.

Scope check

Audit elevation boundaries only on hosts you own or are authorized to assess, on non-production or a snapshot, using a benign marker that proves the high-integrity context was reached rather than taking real administrative action. A confirmed crossing yields administrative rights, so keep every probe within scope. If you can't name the authorization, stop.

The loop

1. Establish whether crossing the boundary needs genuine consent or an existing high context first. For each way a medium-integrity process might reach high integrity, determine whether it requires a real consent prompt or an already-elevated context, or whether an auto-elevating binary, a writable consumed input, or a permissive policy lets the crossing happen without consent. This is the false-positive killer: a boundary that always requires genuine consent or existing elevation is not crossed by a medium-integrity foothold. Name the consent-free crossing before crafting a proof.