Overview
If an application runs with elevated privileges and provides a GUI (file browser, help menu, print dialog), you can abuse it to spawn a command prompt as that user.Identify GUI Apps Running as Admin
File Dialog Escape
Many applications have File → Open or File → Save As dialogs.Steps
- Open the elevated application
- Navigate to File → Open (or Save As, Print, Help)
- In the file dialog address bar, type:
- Press Enter → cmd.exe opens with the application’s privileges
Alternative Paths
Right-click in File Dialog
- In file dialog, navigate to
C:\Windows\System32 - Right-click → Open → select
cmd.exe
Help Menu Escape
- Open Help → About or press F1
- If browser opens → navigate to:
- Or use address bar to navigate to local files
Paint / Notepad / WordPad
If running elevated:Notepad
Paint
Internet Explorer / Edge (Legacy)
If browser runs elevated: Address bar:CVE-2019-1388 — Certificate Dialog
UAC prompt → “Show more details” → certificate issuer link → opens browser as SYSTEM.Requirements
- Windows 7/8/10 (pre-patch)
- Need a signed executable with a certificate that has a URL in the issuer field
Steps
- Run a signed binary (e.g.,
hhupd.exe) - UAC prompt appears → click “Show more details”
- Click “Show information about the publisher’s certificate”
- Click the issuer URL link → browser opens as SYSTEM
- Save As → navigate to
C:\Windows\System32\cmd.exe
Find Suitable Binary
Citrix / RDP Breakout
In restricted Citrix/RDP environments:Task Manager
Sticky Keys Replacement (Physical/RDP)
If you can replacesethc.exe: