Re: Meterpreter scripts for RunAs privilege escalation & other mischief

[Robin Wood <robin () digininja org>]

On 3 December 2010 17:39, Rob Fuller <mubix () room362 com> wrote:
> or you can use railgun and not have to send the execute command ;-)
>
> client.railgun.user32.LockWorkStation()
>
> since railgun is a part of STDAPI now.

Just been looking at the keylogger meterpreter script and seen that it
does it that way.

While in there I also spotted a bug that it doesn't write the keys
collected between the last save and you hitting ctrl-c so I've sent
Carlos a patch so that the last few keys are also collected and
written out to the log.

Robin

> --
> Rob Fuller | Mubix
> Certified Checkbox Unchecker
> Room362.com | Hak5.org
>
>
>
> On Fri, Dec 3, 2010 at 11:26 AM, Robin Wood <robin () digininja org> wrote:
> > On 3 December 2010 16:23, David Porcello <DPorcello () vermontmutual com> wrote:
> > > SendKeys doesn't have a method for the windows key. You can however lock a workstation with rundll: rundll32.exe 
> > > user32.dll, LockWorkStation
> >
> > Brilliant, never knew that, thanks.
> >
> > > Dave.
> > >
> > > -----Original Message-----
> > > From: Robin Wood [mailto:robin () digininja org]
> > > Sent: Friday, December 03, 2010 10:57 AM
> > > To: David Porcello
> > > Cc: framework () spool metasploit com
> > > Subject: Re: [framework] Meterpreter scripts for RunAs privilege escalation & other mischief
> > >
> > > On 3 December 2010 15:48, David Porcello <DPorcello () vermontmutual com> wrote:
> > > > send_keystrokes.rb: Meterpreter script to interactively send keystrokes to
> > > > an open application window using the vbscript SendKeys method. Can be used
> > > > to escalate privileges into RunAs-invoked command shells on XP.
> > >
> > > Can you use this to send a windows key L to lock the screen?
> > >
> > > Robin
> > >
> > > > IE_click_run.rb: Meterpreter script to interactively click "Run" at the IE
> > > > "File Download Security Warning" prompts. Can be used to escalate privileges
> > > > into RunAs-invoked IE instances without end-user interaction on XP.
> > > >
> > > >
> > > >
> > > > http://code.google.com/p/metscripts/downloads/list
> > > >
> > > > http://grep8000.blogspot.com/2010/04/windows-privilege-escalation-talk.html
> > > >
> > > > Dave.
> > > >
> > > > ________________________________
> > > > NOTICE: The information contained in this e-mail and any attachments is
> > > > intended solely for the recipient(s) named above, and may be confidential
> > > > and legally privileged. If you received this e-mail in error, please notify
> > > > the sender immediately by return e-mail and delete the original message and
> > > > any copy of it from your computer system. If you are not the intended
> > > > recipient, you are hereby notified that any review, disclosure,
> > > > retransmission, dissemination, distribution, copying, or other use of this
> > > > e-mail, or any of its contents, is strictly prohibited.
> > > >
> > > > Although this e-mail and any attachments are believed to be free of any
> > > > virus or other defects, it is the responsibility of the recipient to ensure
> > > > that it is virus-free and no responsibility is accepted by the sender for
> > > > any loss or damage arising if such a virus or defect exists.
> > > >
> > > > _______________________________________________
> > > > https://mail.metasploit.com/mailman/listinfo/framework
> > >
> > > NOTICE: The information contained in this e-mail and any attachments is intended solely for the recipient(s) named 
> > > above, and may be confidential and legally privileged. If you received this e-mail in error, please notify the 
> > > sender immediately by return e-mail and delete the original message and any copy of it from your computer system. 
> > > If you are not the intended recipient, you are hereby notified that any review, disclosure, retransmission, 
> > > dissemination, distribution, copying, or other use of this e-mail, or any of its contents, is strictly prohibited.
> > >
> > > Although this e-mail and any attachments are believed to be free of any virus or other defects, it is the 
> > > responsibility of the recipient to ensure that it is virus-free and no responsibility is accepted by the sender for 
> > > any loss or damage arising if such a virus or defect exists.
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework