IPsec Keying Modules Services Windows Local Priv Esc

Exploits missing DLL used by 'IKE and AuthIP IPsec Keying Modules' as found in Windows Vista-Win8 to gain SYSTEM privs. 

Tested in Win7 x86.

<del>This module does not work in x64 - unsure of the cause. LoadImage is called by the service on the x64 generated DLL but the payload is not executed...</del>

There are a few issues with the reporting of file_exists? which often gives the wrong result - this may be due to underlying windows issues - the only way to check for certain is to open/try and create the file to get an exception. UAC makes file_exists? very unreliable so I return if UAC is enabled.

I would like the module to keep the handler open if a restart is required but unsure of best way to achieve this - I tell the user to create a handler manually. This is probably the most likely scenario as users do not have permissions to this service by default.

User requires write permissions to a folder within the system PATH.

 To test (without rebooting) replace the SID with the test user to give them restart/start permissions:

C:\Users\Test>sc sdset IKEEXT D:(A;;RPWPDTLO;;;S-1-5-21-2328614077-3819224548-2155398847-1001)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)