rapid7/metasploit-framework — pull request #1569 by Meatballs1 (2013-03-09 18:00:47+00:00)
Title: Generate MSI Payloads

This allows generation of MSI payloads by replacing a buffer in an existing MSI template with a PE file.

This uses the improved MSI template I recently pulled for AlwaysInstallElevated (which fails installation so no trace is left on the machine). Instead of executing a separate payload.exe it contains a binary file within the MSI.

This MSI file gets extracted to c:\windows\installer\random.tmp and is then executed.

Users are required to enter administrative credentials or accept UAC prompt (if running as admin), but in return you get a SYSTEM shell. An extension to this work could be to work out how to create an MSI file which doesn't require Admin credentials. This would probably require a separate template.

The mechanism for replacing the buffer is relatively crude, the code only performs just enough logic to manipulate the MSI generated by my Wix template. No guarantee if changes to the template will be successful, but may be ok if no additional files or binary streams get added.