File tree Expand file tree Collapse file tree 1 file changed +29
-1
lines changed
modules/exploits/windows/local Expand file tree Collapse file tree 1 file changed +29
-1
lines changed Original file line number Diff line number Diff line change @@ -60,7 +60,35 @@ def exploit
60
60
end
61
61
}
62
62
if not vuln
63
- print_error ( "#{ winver } is not vulnerable." )
63
+ print_error ( "#{ winver } does not have UAC" )
64
+ return
65
+ end
66
+
67
+ root_key , base_key = session . sys . registry . splitkey ( "HKLM\\ Software\\ Microsoft\\ Windows\\ CurrentVersion\\ Policies\\ System" )
68
+ open_key = session . sys . registry . open_key ( root_key , base_key )
69
+ lua_setting = open_key . query_value ( 'EnableLUA' )
70
+
71
+ if lua_setting . data == 1
72
+ print_status "UAC is Enabled, checking level..."
73
+ else
74
+ print_error "UAC is not enabled, no reason to run module, exiting..."
75
+ print_error "Run exploit/windows/local/ask to elevate"
76
+ return
77
+ end
78
+
79
+ uac_level = open_key . query_value ( 'ConsentPromptBehaviorAdmin' )
80
+
81
+ case uac_level . data
82
+ when 2
83
+ print_error "UAC is set to 'Always Notify'"
84
+ print_error "This module does not bypass this setting, exiting..."
85
+ return
86
+ when 5
87
+ print_good "UAC is set to Default"
88
+ print_good "BypassUAC can bypass this setting, continuing..."
89
+ when 0
90
+ print_error "UAC is not enabled, no reason to run module"
91
+ print_error "Run exploit/windows/local/ask to elevate"
64
92
return
65
93
end
66
94
You can’t perform that action at this time.
0 commit comments