From 8d92e34d66151cb1ec3c858957d671fb4e371b13 Mon Sep 17 00:00:00 2001 From: bogey3 <29926385+bogey3@users.noreply.github.com> Date: Fri, 7 Oct 2022 15:55:58 -0400 Subject: [PATCH 1/2] Created install_elevated.py This module will check if the computer and the supplied user have AlwaysInstallElevated enabled. --- cme/modules/install_elevated.py | 43 +++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 cme/modules/install_elevated.py diff --git a/cme/modules/install_elevated.py b/cme/modules/install_elevated.py new file mode 100644 index 00000000..0656bb7e --- /dev/null +++ b/cme/modules/install_elevated.py @@ -0,0 +1,43 @@ +class CMEModule: + + name = 'install_elevated' + description = "Checks for AlwaysInstallElevated" + supported_protocols = ['smb'] + opsec_safe = True + multiple_hosts = True + + def options(self, context, module_options): + ''' + ''' + + def on_admin_login(self, context, connection): + remoteOps = RemoteOperations(connection.conn, False) + remoteOps.enableRegistry() + + try: + ans_machine = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) + regHandle = ans_machine['phKey'] + ans_machine = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, 'SOFTWARE\\Policies\\Microsoft\\Windows\\Installer') + keyHandle = ans_machine['phkResult'] + dataType, aie_machine_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, 'AlwaysInstallElevated') + + rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) + + + ans_user = rrp.hOpenCurrentUser(remoteOps._RemoteOperations__rrp) + regHandle = ans_user['phKey'] + ans_user = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, 'SOFTWARE\\Policies\\Microsoft\\Windows\\Installer') + keyHandle = ans_user['phkResult'] + dataType, aie_user_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, 'AlwaysInstallElevated') + + if aie_user_value == 1 and aie_machine_value == 1: + context.log.highlight('AlwaysInstallElevated Status: 1 (Enabled)') + elif aie_user_value == 0 or aie_machine_value == 0: + context.log.highlight('AlwaysInstallElevated Status: 0 (Disabled)') + + rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) + + except rrp.DCERPCSessionError: + context.log.highlight('AlwaysInstallElevated Status: 0 (Disabled)') + + remoteOps.finish() From 1629029d35d96ecae372eae6f557aa451af8b7cb Mon Sep 17 00:00:00 2001 From: bogey3 <29926385+bogey3@users.noreply.github.com> Date: Fri, 7 Oct 2022 16:25:56 -0400 Subject: [PATCH 2/2] Update install_elevated.py Updated to display enabled when only the entry in HKLM is enabled as low privilege users can modify the HKCU and grant themselves permission. Note that once the per-machine policy for AlwaysInstallElevated is enabled, any user can set their per-user setting. https://learn.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated --- cme/modules/install_elevated.py | 60 +++++++++++++++++++++------------ 1 file changed, 38 insertions(+), 22 deletions(-) diff --git a/cme/modules/install_elevated.py b/cme/modules/install_elevated.py index 0656bb7e..141651be 100644 --- a/cme/modules/install_elevated.py +++ b/cme/modules/install_elevated.py @@ -1,3 +1,10 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +from impacket.dcerpc.v5.rpcrt import DCERPCException +from impacket.dcerpc.v5 import rrp +from impacket.examples.secretsdump import RemoteOperations + class CMEModule: name = 'install_elevated' @@ -11,33 +18,42 @@ class CMEModule: ''' def on_admin_login(self, context, connection): - remoteOps = RemoteOperations(connection.conn, False) - remoteOps.enableRegistry() - try: - ans_machine = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) - regHandle = ans_machine['phKey'] - ans_machine = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, 'SOFTWARE\\Policies\\Microsoft\\Windows\\Installer') - keyHandle = ans_machine['phkResult'] - dataType, aie_machine_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, 'AlwaysInstallElevated') + remoteOps = RemoteOperations(connection.conn, False) + remoteOps.enableRegistry() - rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) + try: + ans_machine = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) + regHandle = ans_machine['phKey'] + ans_machine = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, 'SOFTWARE\\Policies\\Microsoft\\Windows\\Installer') + keyHandle = ans_machine['phkResult'] + dataType, aie_machine_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, 'AlwaysInstallElevated') + rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) + if aie_machine_value == 0: + context.log.highlight('AlwaysInstallElevated Status: 0 (Disabled)') + return - ans_user = rrp.hOpenCurrentUser(remoteOps._RemoteOperations__rrp) - regHandle = ans_user['phKey'] - ans_user = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, 'SOFTWARE\\Policies\\Microsoft\\Windows\\Installer') - keyHandle = ans_user['phkResult'] - dataType, aie_user_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, 'AlwaysInstallElevated') - - if aie_user_value == 1 and aie_machine_value == 1: - context.log.highlight('AlwaysInstallElevated Status: 1 (Enabled)') - elif aie_user_value == 0 or aie_machine_value == 0: + except rrp.DCERPCSessionError: context.log.highlight('AlwaysInstallElevated Status: 0 (Disabled)') + return - rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) - except rrp.DCERPCSessionError: - context.log.highlight('AlwaysInstallElevated Status: 0 (Disabled)') + try: + ans_user = rrp.hOpenCurrentUser(remoteOps._RemoteOperations__rrp) + regHandle = ans_user['phKey'] + ans_user = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, 'SOFTWARE\\Policies\\Microsoft\\Windows\\Installer') + keyHandle = ans_user['phkResult'] + dataType, aie_user_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, 'AlwaysInstallElevated') + rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) - remoteOps.finish() + except rrp.DCERPCSessionError: + context.log.highlight('AlwaysInstallElevated Status: 1 (Enabled: Computer Only)') + return + + if aie_user_value == 0: + context.log.highlight('AlwaysInstallElevated Status: 1 (Enabled: Computer Only)') + else: + context.log.highlight('AlwaysInstallElevated Status: 1 (Enabled)') + finally: + remoteOps.finish()