> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/uac-bypasses.md).

# UAC Bypasses

When you think of User Access Control think of every time your Windows computer prompts you to type in your password before running a program or other privileged task. Often if you are an administrator but don't have GUI access to the target machine, you'll need to bypass UAC in order to run privileged tasks. For example, despite being in the `BUILTIN\Administrators` group, I have to confirm or potentially even type my password into a UAC popup GUI to run `cmd.exe` with Administrator privileges.

## UACMe

[UACMe](https://github.com/hfiref0x/UACME) is a repository detailing a large list of UAC bypasses using built-in Windows features. At the time of writing, this repository covers methods on Windows 7/8/8.1/10/11 (x86-32/x64 clients, however a few methods work on servers too). 

Building this repository solution provides you with akagi32.exe or akagi64.exe binaries, that can take a method number and optional command as parameters.

```bat
akagi64.exe [Method_Number] [Optional_Command]

akagi64.exe 61 c:\windows\system32\calc.exe
```