Executive Summary
Research by AmberWolf reveals a novel technique called NachoMDM that weaponizes the native Windows Mobile Device Management (MDM) enrollment protocol to bypass User Account Control (UAC) and gain NT AUTHORITY\SYSTEM privileges. The attack targets users who are members of the local administrators group but running in a medium-integrity context. By leveraging the native `ms-device-enrollment` URI handler, an attacker can social engineer a victim into a single-click enrollment that connects their device to a rogue MDM server.
Technically, the exploit relies on the fact that the Windows Device Management Client (`omadmclient.exe`) runs as SYSTEM and performs software installations without triggering UAC prompts for enrolled devices. Once the handshake is complete, the rogue server pushes a malicious SyncML payload that utilizes the `EnterpriseDesktopAppManagement` Configuration Service Provider (CSP) to silently install a malicious MSI package.
While Microsoft has reviewed the report and determined it does not meet the bar for a security patch, it remains a significant risk for home users and BYOD environments. In enterprise settings, the risk is partially mitigated if users lack local admin rights or if devices are already enrolled in a legitimate MDM solution, as Windows prevents dual enrollment.