WEBVTT

00:00:00.640 --> 00:00:01.520
Hi everyone.

00:00:01.530 --> 00:00:04.550
I would like to thank you for joining me here on Pluralsight

00:00:04.550 --> 00:00:07.150
with the UACMe privilege escalation tool.

00:00:08.240 --> 00:00:11.770
This is an open source tool under the BSD two‑clause license,

00:00:11.820 --> 00:00:15.160
developed and maintained by nickname hFireF0x.

00:00:15.940 --> 00:00:20.540
UACMe is a privilege escalation tool that can be used on all versions

00:00:20.540 --> 00:00:24.060
of Windows that has User Access Control features.

00:00:24.640 --> 00:00:27.260
It is used by red teamers, pen testers,

00:00:27.270 --> 00:00:30.230
and APT groups to execute malicious payload on a

00:00:30.230 --> 00:00:32.490
target machine with admin privileges.

00:00:32.580 --> 00:00:36.050
If any application intends to undertake any activity

00:00:36.050 --> 00:00:40.960
with a possible system‑wide impact, it cannot do so without the user's consent.

00:00:41.040 --> 00:00:45.360
Credential prompt and consent prompt are two variants of UAC.

00:00:45.440 --> 00:00:49.450
When a standard user attempts to perform an administrative task,

00:00:49.460 --> 00:00:51.510
such as installing a new application,

00:00:51.520 --> 00:00:53.820
they will be prompted to enter administrator

00:00:53.820 --> 00:00:56.130
credentials in order to complete the task.

00:00:56.140 --> 00:00:59.580
However, when an admin user tries to do the same task,

00:00:59.590 --> 00:01:01.850
they will be presented with a consent prompt,

00:01:01.860 --> 00:01:03.830
which the user must simply confirm.

00:01:03.840 --> 00:01:08.410
UACMe simply tries to defeat this consent prompt by abusing the

00:01:08.410 --> 00:01:12.280
built‑in Windows AutoElevate feature. You can get this tool from

00:01:12.280 --> 00:01:15.810
this GitHub repo along with comprehensive documentation on

00:01:15.810 --> 00:01:18.160
building the binary and its usage.

00:01:18.640 --> 00:01:23.010
UACMe with its ease of use and effectiveness will make it easy

00:01:23.010 --> 00:01:26.720
for the red teamer to do their job when facing any target that

00:01:26.720 --> 00:01:28.780
has User Access Control enabled.

00:01:29.040 --> 00:01:33.460
It has more than 60 exploits that can be used to bypass UAC.

00:01:34.010 --> 00:01:38.460
Some of them are fixed on your versions of Windows and they are still out there.

00:01:39.040 --> 00:01:43.510
Blue teamers can also use it to assess the security posture of their assets.

00:01:44.640 --> 00:01:48.770
UACMe happens to land within the cyber kill chain in the

00:01:48.770 --> 00:01:52.790
exploit phase and which can be used to elevate the privileges

00:01:52.790 --> 00:01:54.790
to install a remote access tool,

00:01:55.240 --> 00:01:59.070
operate a credentials dumping tool or execute any sort of

00:01:59.070 --> 00:02:01.820
commands, like changing the victim's password.

00:02:02.210 --> 00:02:05.850
This effort enables the attacker to exploit other targets within

00:02:05.850 --> 00:02:08.460
the internal network in a lateral movement.

00:02:08.900 --> 00:02:13.730
Since UACMe bypasses the User Access Control consent prompt to elevate

00:02:13.730 --> 00:02:18.060
privileges, it is rated inside the MITRE ATT&CK framework under

00:02:18.060 --> 00:02:21.550
privilege escalation and defense evasion tactics.

00:02:22.040 --> 00:02:26.910
It does that by abusing the controls that ask for user consent and loads

00:02:26.910 --> 00:02:31.390
an elevated Component Object Model without triggering a Windows UAC

00:02:31.390 --> 00:02:34.850
consent box, and hence bypasses the whole control.

00:02:35.450 --> 00:02:39.560
Let's see how UACMe usage looks like in a real‑life scenario.

00:02:39.940 --> 00:02:43.370
Here is the network for Globomantics, a company that has

00:02:43.370 --> 00:02:46.260
services published on its DMZ network.

00:02:46.840 --> 00:02:49.980
It also has an internal network for employees.

00:02:50.450 --> 00:02:55.000
An attacker or a red teamer detects a vulnerable service on this network when

00:02:55.000 --> 00:02:59.180
doing information gathering and succeeds by exploiting it.

00:02:59.440 --> 00:03:03.020
Now the attacker is looking to elevate privileges and harvest

00:03:03.020 --> 00:03:06.800
credentials to help them with the lateral movement to exploit

00:03:06.800 --> 00:03:08.650
as many machines as possible.

00:03:09.340 --> 00:03:13.660
Okay, let's see it in action, but first, we should build the source code.