UACME

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor.

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor.

Link:

https://github.com/hfiref0x/UACME

Usage:

Run executable from command line: akagi32 [Key] [Param] or akagi64 [Key] [Param]. See "Run examples" below for more info.

First param is number of method to use, second is optional command (executable file name including full path) to run. Second param can be empty - in this case program will execute elevated cmd.exe from system32 folder.

Example (Windows 10):

C:\Users\Jack\Downloads\UACME-3.2.2\Source\Akagi\output\Win32\Debug>Akagi.exe 53 C:\Windows\System32\cmd.exe

-microsoft Windows [Version 18.8 .17763 . 885] (c) 2818 microsoft Corporation . All rights reserved . : . exe - : \Users\Jack\Down10ads\UACt•1E-3.2.2\Source\Akagi \output\Win32\Debug>Akagi . exe : .exe 48 C: \Windows\System32\cmd .exe : . exe 53 C: . exe Administrator: microsoft windows [Version 18.8.17763.885] (c) 2818 microsoft Corporation. All rights reserved . C: ndows \ system32>

Bins 

- Akagi, x64/x86-32 main executable file, contain payload/data units. 
- Akatsuki, x64 payload, WOW64 logger. 
- Chiyoda, x64 payload, fake w32time service. 
- Fubuki, x64/x86-32 payload, general purpose. 
- Fujinami, x86-32 payload, COM handler dll. 
- Hibiki, x64/x86-32 payload, Application Verifier dll. 
- Ikazuchi, x64/x86-32 payload, SxS DotLocal. 
- Inazuma, x86-32 payload, shellcode for AppCompat. 
- Kamikaze, data, MMC snap-in. 
- Kongou, x64/x86-32 executable data, GWX trigger. 
- Naka, x64/x86-32 compressor for other payload/data units. 
- Yuubari, x64 UAC info data dumper.

Methods

PreviousNishangNextBypass-UAC

Last updated

Was this helpful?