Getuidx64 Require Administrator Privileges

Technical Analysis: The Privilege Escalation Vector of getuidx64

Classification: Security Analysis / Privilege Escalation Status: Requires Mitigation Component: getuidx64 (Conceptual/Custom Driver Module)

Step 1: Verify You Are an Administrator

Before anything else, confirm your account has administrative rights.

• Open Command Prompt (Win + R, type cmd).
• Run whoami /groups | findstr "S-1-5-32-544"
• If you see output containing BUILTIN\Administrators, your account is an admin. If not, contact your IT department.

S-2: Anti-Tampering

• Function validates input pointer before use
• Token handle is opened only with TOKEN_QUERY (minimum required access)

Do not call getuid() directly on Windows

Instead, use Windows API equivalents:

• GetCurrentProcessId() for PID.
• OpenProcessToken() followed by GetTokenInformation(TokenUser) to get SID.
• CheckTokenMembership() to test for admin group.

Distribute a manifest file

Embed a manifest in your executable that declares requestedExecutionLevel="asInvoker" to prevent unnecessary UAC prompts.

---

A. The Handler Routine

The tool functions by registering a generic kernel driver. Once loaded, it exposes an IOCTL (I/O Control) interface. getuidx64 require administrator privileges

Pseudo-code Logic:

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) 
    // Standard driver initialization
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HandleIOCTL;
    return STATUS_SUCCESS;
NTSTATUS HandleIOCTL(PDEVICE_OBJECT DeviceObject, PIRP Irp) 
    // The dangerous part: Interacting with the EPROCESS structure
    // ...

Step 5: Consider Temporary Workarounds (Not Recommended)

If you must run the application without true admin rights and trust the source, you can try: Open Command Prompt (Win + R, type cmd )

• Applying the Compatibility Administrator (from Windows ADK) to create a shim that lies about the integrity level – advanced and risky.
• Running as a different user with local admin rights using runas /user:Administrator "path\to\app.exe".

---

Dependencies

• Windows SDK (security APIs)
• Kernel32.dll, Advapi32.dll

---

The 64-bit tool getuidx64 is used to verify if a user session has successfully elevated to Administrator or SYSTEM-level privileges. While it does not inherently require administrative rights to run, it is frequently used in security contexts where high-level permissions are needed for actions like credential dumping. Pov — HTB Writeups. Windows-Medium | by Alts

---