WEBVTT

00:00:01.040 --> 00:00:03.210
Let's open an elevated command prompt.

00:00:03.210 --> 00:00:07.330
UACMe will try to defeat this consent box right here,

00:00:07.330 --> 00:00:11.310
and this basically works when you have an admin account and the Windows

00:00:11.310 --> 00:00:14.520
User Account Control is not set to always notify.

00:00:14.520 --> 00:00:18.850
Going to the GitHub repo, you can see the usage documentation.

00:00:19.460 --> 00:00:21.350
The invocation is pretty easy.

00:00:21.740 --> 00:00:25.660
This tool takes two arguments, the key and the parameter.

00:00:26.140 --> 00:00:30.450
The key is the number of the method to use to bypass UAC and

00:00:30.450 --> 00:00:34.490
the parameter is the full path to an EXE, or a whole separate

00:00:34.490 --> 00:00:36.340
command line with its parameters.

00:00:36.550 --> 00:00:41.350
When this parameter is left empty, an elevated command prompt will be launched.

00:00:42.040 --> 00:00:46.110
The Keys section here contains the list of fixed and removed methods,

00:00:46.210 --> 00:00:50.700
along with a list of effective bypass methods that you can use in this process.

00:00:50.720 --> 00:00:53.200
Here we chose the type, method,

00:00:53.210 --> 00:00:56.720
target, and other information this particular bypass method

00:00:56.720 --> 00:01:02.230
implements. I chose method number 33 since I know it will work

00:01:02.230 --> 00:01:06.420
against all my targets I have here. You can use an experiment

00:01:06.420 --> 00:01:08.160
with any method of your choosing.

00:01:09.440 --> 00:01:11.620
Moving to the privilege escalation section.

00:01:11.630 --> 00:01:15.550
When starting the command line prompt and the list of privileges it carries,

00:01:15.550 --> 00:01:18.950
you'll notice here that it shows Medium Mandatory Level.

00:01:19.640 --> 00:01:23.560
That means when an admin triggers an action that impacts the system,

00:01:23.940 --> 00:01:28.300
it will prompt the user with a consent box to approve it, comparing

00:01:28.300 --> 00:01:32.360
that with starting a command prompt using UACMe Akagi.

00:01:35.840 --> 00:01:39.750
Listing the privileges, here the story is different.

00:01:40.340 --> 00:01:44.940
It has changed to High Mandatory Level, which indicates executing any

00:01:44.940 --> 00:01:50.170
command without prompting the user and a consent box. Going back to an

00:01:50.170 --> 00:01:54.210
unprivileged command prompt, it will prevent the user from changing the

00:01:54.210 --> 00:01:57.960
password, whereas when using Akagi to do so,

00:01:58.540 --> 00:02:00.460
the task will be done right away.