rapid7/metasploit-framework — pull request #2162 by Meatballs1 (2013-07-26 02:21:39+00:00)
Title: Exploits MS13-005 - Low Integrity to Medium Integrity Local Priv Esc

Tested on IE8-Win7 VM from: http://www.modern.ie/en-US/virtualization-tools#downloads
Also tested on the Vista one but that doesn't support the spawning of a shell as no shortcut :(

To test:

icacls meterp.exe /set integritylevel low

ProcExp can tell you if a process is medium or low integrity for success.

Possible Improvements:
The low integrity check could possibly be refactored into Post::Accounts? But that's pending in another PR. It would also benefit from being railgunned.

Would the typing go faster if we did a multi railgun call?

Could add an option to just write the whole payload command rather than web download, but I expect that'd be a separate module? If we're getting in as a low integrity process we probably exploiting IE anyway so have web access...