rapid7/meterpreter — pull request #36 by OJ (2013-10-21 01:12:10+00:00)
Title: Fix shell creation in XP edge-case scenario

Today I found a scenario where spawning shells on Windows XP SP0 wasn't
working. This wasn't happening on Windows XP SP2, so it could be specific
to SP0.

The user was an administrative user, but running `shell` from the
Meterpreter prompt was resulting in the following error:

meterpreter > shell
[-] stdapi_sys_process_execute: Operation failed: 1314

1314 indicates `ERROR_PRIVILEGE_NOT_HELD`, which for some reason implies
that the current user can't impersonate the current token for the
attempted call to `CreateProcessAsUser`.

The code attempts to fallback on `CreateProcessWithToken`, but this isn't
available on XP.

This commit creates another fallback which simple calls `CreateProcess`
with the same detail as the `CreateProcessAsUser` call. While it might not
function the same way as the `CreateProcessAsUser` call does, at least it
gives an interactive shell.

### Verification

Prior to applying the fix:

- [ ] Windows XP SP 0 must be used/tested.
- [ ] Executing `shell` must result in `stdapi_sys_process_execute: Operation failed: 1314`

After applying the fix:

- [ ] Windows XP SP 0 must be used/tested.
- [ ] Executing `shell` results in an interactive shell.