Building the project

[ghost]

I have compiled Akagi after generating the .cd/.key files but wanted to check I built it correctly. As I noticed when compiling the whole project (uacme.sln) with empty .key/.cd files it still builds. SIDENOTE: Why does it still build if these are empty?

Some methods were working but some weren't so wanted to sanity check if I messed up the build.

These are the steps I took to compile:

1. Compiled every module separately as Release for every project file (.vcxproj). (I did both arches if there was a project file for it, 32/64bit) For this I went through the targets list is VS Studio.(dll.vcxproj,Akatsuki.vcxproj,Naka.vcxproj)
2. Used Naka going through every dll + Kamikaze.msc: .\Naka64.exe C:\...\UACME-master\Source\Fubuki\output\Win32\Release\Fubuki32.dll

I did this for the following files:

Fubuki32.dll
Fubuki64.dll
Akatsuki64.dll
Kamikaze.msc

Then ran Naka64.exe --stable resulting in the below:

Length Name
------ ----
5424 Akatsuki64.cd
32 Akatsuki64.key
9776 Fubuki32.cd
32 Fubuki32.key
10944 Fubuki64.cd
32 Fubuki64.key
8384 Kamikaze.cd
32 Kamikaze.key
72 secrets32.bin
108 secrets64.bin

3. I moved all the above (cd/key/bin) to Source\Akagi\bin.
4. Selected uacme.sln and built "Release|64" and "Release|Win32".

[hfiref0x]

Why does it still build if these are empty

It builds because files are present on disk. Resource compiler doesn't check what they are. Empty files mean - every method that uses them will fail to execute. Methods that does not rely on these dlls will still work.

[ghost]

Thank you for your answer. Do you see any issues with the way I've compiled the project?

[hfiref0x]

You don't need any *.key files inside Akagi\Bin, they are used by naka to generate you secrets32/64 files and no longer needed after that.

[ghost]

Gotcha, but overall am I correct in assuming that following the steps I took this should build a fully working UACME?

[hfiref0x]

Yes.

[ghost]

Yes.

thank you 👍 Curious a few general Qs:

• Is there a reason why you have decided to let it fail silently as opposed to an error?
• Why do you go through the steps of encrypting the modules in this way? (As the main akagi module will still be flagged by AV so not useful for evasion) Interested in the design choice.

[hfiref0x]

It is not for av evasion. It is intentional complication of compilation process to make sure people who will do this understand what they do and not just copy-paste with their own copyrights like some Chinese haxor did in 2015 with his "bypassuac". Additionally it serves like an "idiot protection" from these who use modules from uacme for their own malware which then described by some wannabe security trash as "APT", e.g. Cymmetria with their fake APT campaing called "patchwork". No other reasons behind this.

[ghost]

It is not for av evasion. It is intentional complication of compilation process to make sure people who will do this understand what they do and not just copy-paste with their own copyrights like some Chinese haxor did in 2015 with his "bypassuac". Additionally it serves like an "idiot protection" from these who use modules from uacme for their own malware which then described by some wannabe security trash as "APT", e.g. Cymmetria with their fake APT campaing called "patchwork". No other reasons behind this.

Fair enough 👍

• Is there a debug option I missed to enable more verbose statements. For example to notify if the payload wasn't compiled properly, empty .cd instead of the final exec failing silently?
• Do all the payloads accept an executable path as a parameter? I looked at the source for some payloads and say that most of them do.

[hfiref0x]

There is no verbose output, in fact there is almost no output entirely in program or it components. Normally when main executable exits it should return 0 and other value in case of error.

All methods accept parameter to execute.

[ghost]

Gotcha, am I correct in saying there is no way to really test if the payloads are correctly compiled into Akagi? (fails silently) How would you recommend I check that the payloads are correctly in there or is the only way to check to just run the binary/method on test machine and if it doesn't do anything assume it was a compilation error.

[hfiref0x]

You have to rewrite the part of akagi where it executes ucmMain, so when process terminates it will return result which you later can query through GetExitCodeProcess. The value you want to check is STATUS_DATA_ERROR. Currently akagi executes it real entry point through various manipulations with indirect calls in Stub.c because of previous WD annoyance. Normally main should only call ExitProcess(ucmMain(with defaulted parameters)).

[ghost]

Thank you 👍 And great tool!