README.md

POCs built in Rust

UAC Bypasses

• mock-trusted-directories - bypasses UAC by using a fake trusted directory.
• windir-with-silentcleanup-task - bypasses UAC by mocking the WinDir environment variable, and using the SilentCleanup task.

All of these POCs execute cmd.exe by default.