rapid7/metasploit-framework — pull request #1054 by Meatballs1 (2012-11-11 15:11:51+00:00)
Title: IPsec Keying Modules Services Windows Local Priv Esc

Exploits missing DLL used by 'IKE and AuthIP IPsec Keying Modules' as found in Windows Vista-Win8 to gain SYSTEM privs.

Tested in Win7 x86.

This module does not work in x64 - unsure of the cause. LoadImage is called by the service on the x64 generated DLL but the payload is not executed...

There are a few issues with the reporting of file_exists? which often gives the wrong result - this may be due to underlying windows issues - the only way to check for certain is to open/try and create the file to get an exception. UAC makes file_exists? very unreliable so I return if UAC is enabled.

I would like the module to keep the handler open if a restart is required but unsure of best way to achieve this - I tell the user to create a handler manually. This is probably the most likely scenario as users do not have permissions to this service by default.

To test (without rebooting) replace the SID with the test user to give them restart/start permissions:

C:\Users\Test>sc sdset IKEEXT D:(A;;RPWPDTLO;;;S-1-5-21-2328614077-3819224548-2155398847-1001)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)