rapid7/metasploit-framework — pull request #3028 by dmaloney-r7 (2014-02-23 21:32:30+00:00)
Title: Update/Revamp of bypass-uac

This PR updates the source code of bypass-uac:

Project is updated to compile under Visual Studio 2013 to conform with our current build practices
Command Line usage help has been removed to eliminate unnecessary code and obvious strings
The CLogger class has been removed as it is unwanted outside of debugging and creates additional obvious strings and behaviour which lead to AV detections

The result is two new binaries that still work as intended but avoid almost all AV detections( The x64 binary does avoid all of them)

VERIFICATION STEPS
- [ ] Get a shell on a Windows Vista or later box that does not have system privs
- [ ] verify getystsem fails due to UAC
- [ ] verify you are under an Admin user's context
- [ ] Run the bypass-uac local exploit
- [ ] VERIFY you get a new session
- [ ] VERIFY getsystem now works on this new session
- [ ] VERIFY the same steps on an x64 system using an x64 payload

Optional Verification Steps
- [ ] pick you favorite AV
- [ ] install it on the target system
- [ ] reproduce the above steps
- [ ] VERIFY you still get an elevated session