UAC Evasion Development

Implement prompt-free medium→high integrity escalation inside a loader/agent, not as a separate exploit step. Scope: the medium→high jump. Token-level privilege escalation to SYSTEM (Potato family) is the privesc catalog in post-exploit-technique/references/windows-privesc.md; the chain orchestration that stitches UAC→admin→SYSTEM is covered here.

When to activate

• Implementing a UAC bypass inside a loader, agent, or BOF
• Reviewing a bypass for OPSEC (cleanup, artifacts, telemetry)
• Chaining medium→high→SYSTEM in one process tree
• Deciding whether a bypass is worth it vs asking the user for elevation

UAC mechanics that gate every bypass

• Elevation policy: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System — ConsentPromptBehaviorAdmin (0 = silent elevate, 2 = prompt on secure desktop [default], 5 = consent for non-Windows binaries only) and EnableLUA. Enumerate before choosing a method — 0 means no bypass is needed.
• Auto-elevate requirements for a binary to self-elevate without prompt: autoElevate="true" in its manifest, signed by the Windows publisher, launched from a trusted path. Every bypass family abuses one leg of this triad.
• COM auto-elevation: CLSIDs whose LocalizedString/Elevation registry values point into system32 elevate on CoCreateInstance from medium integrity — the class-based family (CMSTPLUA, ICMLuaUtil, …).
• High-integrity processes only check the first two legs for their own children — once you are high, spawning elevated children is free.

Bypass families (implementation-oriented)