Hi everyone.
I would like to thank you for joining me here on Pluralsight
with the UACMe privilege escalation tool.
This is an open source tool under the BSD two‑clause license,
developed and maintained by nickname hFireF0x.
UACMe is a privilege escalation tool that can be used on all versions
of Windows that has User Access Control features.
It is used by red teamers, pen testers,
and APT groups to execute malicious payload on a
target machine with admin privileges.
If any application intends to undertake any activity
with a possible system‑wide impact, it cannot do so without the user's consent.
Credential prompt and consent prompt are two variants of UAC.
When a standard user attempts to perform an administrative task,
such as installing a new application,
they will be prompted to enter administrator
credentials in order to complete the task.
However, when an admin user tries to do the same task,
they will be presented with a consent prompt,
which the user must simply confirm.
UACMe simply tries to defeat this consent prompt by abusing the
built‑in Windows AutoElevate feature. You can get this tool from
this GitHub repo along with comprehensive documentation on
building the binary and its usage.
UACMe with its ease of use and effectiveness will make it easy
for the red teamer to do their job when facing any target that
has User Access Control enabled.
It has more than 60 exploits that can be used to bypass UAC.
Some of them are fixed on your versions of Windows and they are still out there.
Blue teamers can also use it to assess the security posture of their assets.
UACMe happens to land within the cyber kill chain in the
exploit phase and which can be used to elevate the privileges
to install a remote access tool,
operate a credentials dumping tool or execute any sort of
commands, like changing the victim's password.
This effort enables the attacker to exploit other targets within
the internal network in a lateral movement.
Since UACMe bypasses the User Access Control consent prompt to elevate
privileges, it is rated inside the MITRE ATT&CK framework under
privilege escalation and defense evasion tactics.
It does that by abusing the controls that ask for user consent and loads
an elevated Component Object Model without triggering a Windows UAC
consent box, and hence bypasses the whole control.
Let's see how UACMe usage looks like in a real‑life scenario.
Here is the network for Globomantics, a company that has
services published on its DMZ network.
It also has an internal network for employees.
An attacker or a red teamer detects a vulnerable service on this network when
doing information gathering and succeeds by exploiting it.
Now the attacker is looking to elevate privileges and harvest
credentials to help them with the lateral movement to exploit
as many machines as possible.
Okay, let's see it in action, but first, we should build the source code.