CMSTP-Elevator

A (super dupe cool) implementation of the CMSTP UAC bypass technique using Java and JNA.

DISCLAIMER

This project is purely for educational and authorized testing purposes only. Unauthorized use of this program is highly unethical and illegal. Usage of this tool is completely your own responsibility, and I am not responsible for any misuse or damage caused by this program.

What is CMSTP?

CMSTP.exe is a legitimate Windows binary that can be abused to bypass User Account Control (UAC) and execute code with elevated privileges. This technique is already widely known and has been documented by security researchers here: MITRE ATT&CK T1218.003

How this program implements this.

1. Create a specially crafted INF configuration file (extension realistically doesn't matter)
2. Execute cmstp.exe with the configuration file
3. Automatically hide this window and interact with it using JNA
4. Make cmstp.exe execute the current jar as admin
5. Start an elevated powershell without the user ever seeing a UAC prompt

Requirements

• Account with Admin privileges
• Java 8 or higher
• JNA library (bundled using Shadow JAR)

How to run

First execute the following command to build a jar to build/libs/CMSTP-Elevator-1.0.jar:

./gradlew build

You can then run this jar within build/libs using:

java -jar CMSTP-Elevator-1.0.jar

The process will then attempt to elevate its privileges amd spawn an elevated PowerShell window.