rapid7/metasploit-framework — pull request #2431 by Meatballs1 (2013-09-27 09:04:15+00:00)
Title: In Memory BypassUAC

The only file required to bypassuac is CRYPTBASE.dll (or another dll style hijack).

Current bypassuac drops a Meterpreter executable, Bypass UAC executable, which extracts another 'TIOR.exe' (used for IPC?) and CRYPTBASE.dll. 4 binaries!

The new technique just drops CRYPTBASE.dll (now our meterpreter payload) which is moved by the injected process into the sysprep folder. I have left the old module in-place as the new technique has some quirks:
•When injecting in SYSWOW64 the injected code is unable to cleanup - despite disabling the redirection. We use the filedropper to cleanup instead.
•The DLL is loaded twice by the module. In the existing module the injected DLL calls ExitProcess() which prevents this; and the subsequent error message from Sysprep.exe. Instead we try and kill the sysprep.exe process after a short period so the message box doesn't alarm a user. This would be better if we could modify the DLL process on the fly to ExitProcess rather than ExitThread but I'm not clever enough to manage this yet (well without modifying the template and recompiling it).

This pull is branched off https://github.com/rapid7/metasploit-framework/pull/2282 which ideally would be committed first