search

hfiref0x / UACME

Defeating Windows User Account Control
BSD 2-Clause "Simplified" License
6.08k stars 1.3k forks source link

Successful build... But at what cost? #152

Closed quuuut closed 2 months ago

quuuut commented 2 months ago

decided to put something as the title.

As the title suggests, The binary came out with all the icons and everything, but executing it with the correct params/no params returned nothing. ` C:\Users\win10\source\repos\UACME\Source\Akagi\output\x64\Release>Akagi64.exe

C:\Users\win10\source\repos\UACME\Source\Akagi\output\x64\Release> C:\Users\win10\source\repos\UACME\Source\Akagi\output\x64\Release>Akagi64.exe 1 C:\Windows\System32\cmd.exe

C:\Users\win10\source\repos\UACME\Source\Akagi\output\x64\Release>`

Can someone help? Windows SDK ver: 10.0.20348.0 Visual Studio ver: Community 2022 (windows defender protection off)

hfiref0x commented 2 months ago

Method 1 obsolete and not present in 3.6.6 version as I assume you compiled it. This is clearly stated in the readme file under "Keys" section.

quuuut commented 2 months ago

I tried it under other keys, but still did not output anything. (tried key 37)

hfiref0x commented 2 months ago

How did you build it?

quuuut commented 2 months ago

Started with debugger, failed build so I read the README, placed all binaries in the repo's root bin dir, and ran Naka64 on all of the DLLs and EXEs. I then compiled Akagi by right clicking on the project and clicking Build.

hfiref0x commented 2 months ago

Did you generated secrets blob for your binaries in bin folder?

quuuut commented 2 months ago

I ran Naka64 in the repo root's bin folder, which put everything (including secrets) inside it.

hfiref0x commented 2 months ago

When you run naka over dll files it generates AES encrypted binaries, with CD extension. Next you need to build secrets blob by running "naka64 --stable" (without quotes). If everything is done properly result will be secrets32/secrets64.bin files. After this you should rebuild akagi.exe in Release configuration.

quuuut commented 2 months ago

I'll try it when I can.

quuuut commented 2 months ago

@hfiref0x Just tried what you told me to do. .CD files generate, but running "naka64 --release" did nothing to the directory. The "Akagi" dir in Source has a folder called "bin". It has all the files needed, but they are all 0 bytes in size.

Edit: i put --release instead of --stable. It outputs a file read error. "File read error, memory not allocated."

hfiref0x commented 2 months ago

You didn't compiled what is required for this operation. You need all dlls compiled and placed in dir where you will compress them with naka first and then generate secrets blobs.

I'm not going to give any detailed instructions here. If you cannot solve this having all the source available, well maybe trying something you don't understand was not a best idea from start?