3 of 6
added 4 characters in body
Michael
  • 5.3k
  • 2
  • 30
  • 56

Ran into the same issue when reproducing.

UPDATE:

When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. The exact steps are:

  • Generate an undetectable reverse shell exe (let's call it undetectabletrojan.exe)
  • Get a meterpreter session with no privileges
  • Upload undectabletrojan.exe via the non-privileged session (e.g. to c:\tmp)
  • Background this unprivileged session and set up a new exploit (windows/local/ask)
  • Set the following options of the windows/local/ask exploit:
    • set filename undectabletrojan.exe
    • set path c:\tmp
  • exploit
  • You will have a second session, privileged.

The fix is to modify /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb .

  • At line 23 it mentions print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...")

  • Modify this to: print_status("Uploading #{payload_filename}...")

  • Save

  • Exit msfconsole

  • Make sure to run 'reload-all' after restarting msfconsole

Then it worked for me, although I had to restart msfconsole a couple of times before the change came through. Let me know what it says.

Michael
  • 5.3k
  • 2
  • 30
  • 56