@@ -26,17 +26,17 @@ def initialize(info={})
26
26
applications from medium or high integrity applications. This allows commands to be
27
27
broadcasted to an open medium or high integrity command prompts allowing escalation
28
28
of privileges. We can spawn a medium integrity command prompt, after spawning a low
29
- integrity command prompt, by using the Win+Shift+# combination to specify the position
30
- of the command prompt on the taskbar. We can then broadcast our command and hope that
31
- the user is away and doesn't corrupt it by interacting with the UI. Broadcast issue
32
- affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2, Server 2012, RT.
33
- But Spawning a command prompt with the shortcut key does not work in Vista so you will
34
- have to check if the user is already running a command prompt and set SPAWN_PROMPT
35
- false. The WEB technique will use powershell to download and execute a powershell
36
- encoded payload. The FILE technique will drop an executable to the file system, set it
37
- to medium integrity and execute it. The TYPE technique will attempt to execute a
38
- powershell encoded payload directly from the command line but it may take some time to
39
- complete.
29
+ integrity command prompt, by using the Win+Shift+# combination to specify the
30
+ position of the command prompt on the taskbar. We can then broadcast our command
31
+ and hope that the user is away and doesn't corrupt it by interacting with the UI.
32
+ Broadcast issue affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2,
33
+ Server 2012, RT. But Spawning a command prompt with the shortcut key does not work
34
+ in Vista so you will have to check if the user is already running a command prompt
35
+ and set SPAWN_PROMPT false. The WEB technique will execute a powershell encoded
36
+ payload from a Web location. The FILE technique will drop an executable to the
37
+ file system, set it to medium integrity and execute it. The TYPE technique will
38
+ attempt to execute a powershell encoded payload directly from the command line but
39
+ it may take some time to complete.
40
40
} ,
41
41
'License' => MSF_LICENSE ,
42
42
'Author' =>
@@ -68,7 +68,6 @@ def initialize(info={})
68
68
OptBool . new ( 'SPAWN_PROMPT' , [ true , 'Attempts to spawn a medium integrity command prompt' , true ] ) ,
69
69
OptEnum . new ( 'TECHNIQUE' , [ true , 'Delivery technique' , 'WEB' , [ 'WEB' , 'FILE' , 'TYPE' ] ] ) ,
70
70
OptString . new ( 'CUSTOM_COMMAND' , [ false , 'Custom command to type' ] )
71
-
72
71
] , self . class
73
72
)
74
73
@@ -162,6 +161,7 @@ def exploit
162
161
if datastore [ 'CUSTOM_COMMAND' ]
163
162
command = datastore [ 'CUSTOM_COMMAND' ]
164
163
else
164
+ print_warning ( "WARNING: It can take a LONG TIME to broadcast the cmd script to execute the psh payload" )
165
165
command = cmd_psh_payload ( payload . encoded )
166
166
end
167
167
make_it ( command )
0 commit comments