UACMe

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. This project demonstrates various UAC bypass techniques and serves as an educational resource for understanding Windows security mechanisms.

⚠️ Warning: This tool demonstrates security vulnerabilities that could be exploited maliciously. Use responsibly and only in controlled environments.

System Requirements

• Operating Systems: Windows 7/8/8.1/10/11 (x86-32/x64, client, some methods however works on server version too)
• User Account: Administrator account with UAC set on default settings

Usage

Run the executable from command line using the following syntax:

akagi32.exe [Method_Number] [Optional_Command]

or

akagi64.exe [Method_Number] [Optional_Command]

Parameters:

• Method_Number: Number corresponding to the UAC bypass method (see Methods List below)
• Optional_Command: Full path to an executable file to run with elevated privileges
  • If omitted, the program will launch an elevated command prompt (%systemroot%\system32\cmd.exe)

Examples:

akagi32.exe 23
akagi64.exe 61
akagi32.exe 23 c:\windows\system32\calc.exe
akagi64.exe 61 c:\windows\system32\charmap.exe

Note: Since version 3.5.0, all previously "fixed" methods are considered obsolete and have been removed. If you need them, use v3.2.x branch.

Note: As of version 3.7.0, methods "fixed" between 3.5.0 and 3.7.0 have been removed from UACMe methods table. If you need them, use the v3.6.x_plus branch The code for these methods is still available in the current branch for historical purposes.

Important Notes:

• Method 30, 63 and later are implemented only in x64 version
• Method 30 requires x64 because it exploits WOW64 subsystem feature
• Method 55 is included primarily for educational purposes and may not be reliable
• Method 78 requires that the current user account password is not blank

Warning

⚠️ Important Security and Usage Information:

• This tool demonstrates only publicly known UAC bypass methods used by malware. It reimplements some techniques in different ways to improve upon original concepts.
• Not intended for antivirus testing and not guaranteed to work in environments with aggressive security software. Use with active antivirus at your own risk.
• Many antivirus solutions may flag this tool as a "HackTool" - this is expected behavior due to its capabilities.
• Clean up after usage: If running on a production system, ensure you remove all program artifacts afterward. See source code for details about files dropped to system folders.
• Most methods were developed primarily for x64 systems. While many can work on x86-32 with minor adjustments, 32-bit support is not a focus of this project.
• For an official Microsoft explanation on why UAC bypasses still exist, see: Microsoft's stance on UAC

Windows 10 support and testing policy

• UACMe is tested only with LSTB/LTSC variants (1607/1809) and the current RTM-1 versions
• For example: if the current version is 2004, it will be tested on 2004 (19041) and the previous 1909 (18363)
• Insider builds are not supported as methods may be fixed in preview releases

Protection Measures

The most effective protection against UAC bypass techniques is using an account without administrative privileges.

Build instructions

UACMe is written in C and requires Microsoft Visual Studio 2019 or later to build from source.

Prerequisites

• IDE: Microsoft Visual Studio 2019/2022/2026 and later version
• SDK Requirements:
  • Windows 8.1 or Windows 10/11 SDK (tested with 19041/26100 version)

Build Steps

1. Configure Platform ToolSet (Project->Properties->General):

   • For Visual Studio 2022: Select v143
   • For Visual Studio 2026: Select v145

2. Set Target Platform Version (Project->Properties->General):

   • For v140: Select 8.1 (Windows 8.1 SDK must be installed)
   • For v141 and above: Select 10

3. Build Process:

   • Compile payload units
   • Compile Naka module
   • Encrypt all payload units using Naka module
   • Generate secret blobs for these units using Naka module
   • Move compiled units and secret blobs to the Akagi\Bin directory
   • Rebuild Akagi

Note: Compiled binaries are not provided and will never be provided. This serves as a barrier against malicious usage and helps maintain the educational purpose of this project.

Legal Disclaimer

• This tool is provided for educational and research purposes only
• We do not take any responsibility for this tool being used in malicious activities
• We have no affiliation with any "security company" using this code for commercial activities
• This GitHub repository (hfiref0x/UACME) is the only genuine source for UACMe code

Support

If you find this project interesting, you can buy me a coffee

BTC (Bitcoin): bc1qzkvtpa0053cagf35dqmpvv9k8hyrwl7krwdz84q39mcpy68y6tmqsju0g4

References

• Windows 7 UAC whitelist, http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
• Malicious Application Compatibility Shims, https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf
• Junfeng Zhang from WinSxS dev team blog, https://blogs.msdn.microsoft.com/junfeng/
• Beyond good ol' Run key, series of articles, http://www.hexacorn.com/blog
• KernelMode.Info UACMe thread, https://www.kernelmode.info/forum/viewtopicf985.html?f=11&t=3643
• Command Injection/Elevation - Environment Variables Revisited, https://breakingmalware.com/vulnerabilities/command-injection-and-elevation-environment-variables-revisited
• "Fileless" UAC Bypass Using eventvwr.exe and Registry Hijacking, https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
• Bypassing UAC on Windows 10 using Disk Cleanup, https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/
• Using IARPUninstallStringLauncher COM interface to bypass UAC, http://www.freebuf.com/articles/system/116611.html
• Bypassing UAC using App Paths, https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
• "Fileless" UAC Bypass using sdclt.exe, https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
• UAC Bypass or story about three escalations, https://habrahabr.ru/company/pm/blog/328008/
• Exploiting Environment Variables in Scheduled Tasks for UAC Bypass,

Authors

(c) 2014 - 2026 UACMe Project