##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'msf/core/post/common'
require 'rex'
require 'zlib'


class Metasploit3 < Msf::Exploit::Local
	Rank = ExcellentRanking

	include Msf::Exploit::EXE
	include Msf::Post::Common
	include Msf::Post::File

	def initialize(info={})
		super(update_info(info, {
			'Name'          => 'Windows Escalate Task Scheduler XML Privilege Escalation',
			'Description'   => %q{
					This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet.
				When processing task files, the Windows Task Scheduler only uses a CRC32
				checksum to validate that the file has not been tampered with. Also, In a default
				configuration, normal users can read and write the task files that they have
				created. By modifying the task file and creating a CRC32 collision, an attacker
				can execute arbitrary commands with SYSTEM privileges.

				NOTE: Thanks to webDEViL for the information about disable/enable.
			},
			'License'       => MSF_LICENSE,
			'Author'        => [ 'jduck' ],
			'Version'       => '$Revision