rapid7/metasploit-framework — pull request #936 by Meatballs1 (2012-10-19 23:44:06+00:00)
Title: Windows Post Module - Insecure Path Enumeration

Checks folders in the system PATH environment variable for current user write access.

This module is an aid to help discover binary planting/dll hijacking issues on a host in an attempt to escalate privileges. The path environment variable is the last thing searched for by the LoadLibrary functions to find DLLs. It may contain user writable directories from insecure installations of third party applications.

Windows PrivEsc Example: https://www.htbridge.com/advisory/HTB23108

I have attempted to do a local exploit for the above which builds on this module but could not get it to successfully load the DLL (it does inspect the dll it as expected if put one of the folders in the PATH):

https://github.com/Meatballs1/metasploit-framework/blob/local_win_priv_keyring/modules/exploits/windows/local/ipsec_keyring_service.rb

If anyone can work out why please feel free to grab code or poke me to finish it! Nb the POC didn't work from HTBridge didn't work but it did have LoadImage called on it by the service - metasploit generated DLLs didn't...