rapid7/metasploit-framework — pull request #2288 by Meatballs1 (2013-08-26 23:28:16+00:00)
Title: In memory BypassUAC

The only file required to bypassuac is CRYPTBASE.dll (or another dll style hijack).

Current bypassuac drops a Meterpreter executable, Bypass UAC executable, which extracts another 'TIOR.exe' (used for IPC?) and CRYPTBASE.dll. 4 binaries!

The new technique just drops CRYPTBASE.dll which is moved by the injected process into the sysprep folder. I have left the old module in-place as the new technique has some quirks:

- When injecting in SYSWOW64 the injected code is unable to cleanup - despite disabling the redirection. We use the filedropper to cleanup instead.
- The DLL is loaded twice by the module. In the existing module the injected DLL calls ExitProcess() which prevents this and the subsequent error message from Sysprep.exe. Instead we try and kill the sysprep.exe process after a short period so the message box doesn't alarm a user. This would be better if we could modify the DLL process on the fly to ExitProcess rather than ExitThread but I'm not clever enough to manage this yet :)

Had to fix dll generation in Exploit::Exe as architecture was wrong wrong (comparing ['x86_64'] to 'x86_64').

I also based this branch off of https://github.com/rapid7/metasploit-framework/pull/2282