automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -128302,56 +128302,6 @@
     "needs_cleanup": true,
     "actions": []
   },
-  "exploit_osx/local/persistence": {
-    "name": "Mac OS X Persistent Payload Installer",
-    "fullname": "exploit/osx/local/persistence",
-    "aliases": [],
-    "rank": 600,
-    "disclosure_date": "2012-04-01",
-    "type": "exploit",
-    "author": [
-      "Marcin 'Icewall' Noga <[email protected]>",
-      "joev <[email protected]>"
-    ],
-    "description": "This module provides a persistent boot payload by creating a launch item, which can be\n          a LaunchAgent or a LaunchDaemon. LaunchAgents run with user level permissions and are triggered\n          upon login by a plist entry in ~/Library/LaunchAgents. LaunchDaemons run with\n          elevated privilleges, and are launched before user login by a plist entry in the ~/Library/LaunchDaemons directory.\n          In either case the plist entry specifies an executable that will be run before or at login.",
-    "references": [],
-    "platform": "OSX,Python,Unix",
-    "arch": "",
-    "rport": null,
-    "autofilter_ports": [],
-    "autofilter_services": [],
-    "targets": [
-      "Mac OS X x64 (Native Payload)",
-      "Mac OS X x86 (Native Payload for 10.14 and earlier)",
-      "Mac OS X Apple Sillicon",
-      "Python payload",
-      "Command payload"
-    ],
-    "mod_time": "2025-06-23 12:43:46 +0000",
-    "path": "/modules/exploits/osx/local/persistence.rb",
-    "is_install_path": true,
-    "ref_name": "osx/local/persistence",
-    "check": false,
-    "post_auth": false,
-    "default_credential": false,
-    "notes": {
-      "Reliability": [
-        "unknown-reliability"
-      ],
-      "Stability": [
-        "unknown-stability"
-      ],
-      "SideEffects": [
-        "unknown-side-effects"
-      ]
-    },
-    "session_types": [
-      "shell",
-      "meterpreter"
-    ],
-    "needs_cleanup": null,
-    "actions": []
-  },
   "exploit_osx/local/root_no_password": {
     "name": "Mac OS X Root Privilege Escalation",
     "fullname": "exploit/osx/local/root_no_password",
@@ -129065,6 +129015,65 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_osx/persistence/launch_plist": {
+    "name": "Mac OS X Persistent Payload Installer",
+    "fullname": "exploit/osx/persistence/launch_plist",
+    "aliases": [
+      "exploits/osx/local/persistence"
+    ],
+    "rank": 600,
+    "disclosure_date": "2012-04-01",
+    "type": "exploit",
+    "author": [
+      "Marcin 'Icewall' Noga <[email protected]>",
+      "joev <[email protected]>"
+    ],
+    "description": "This module provides a persistent boot payload by creating a launch item, which can be\n          a LaunchAgent or a LaunchDaemon. LaunchAgents run with user level permissions and are triggered\n          upon login by a plist entry in ~/Library/LaunchAgents. LaunchDaemons run with\n          elevated privilleges, and are launched before user login by a plist entry in the ~/Library/LaunchDaemons directory.\n          In either case the plist entry specifies an executable that will be run before or at login.\n\n          Verified on OSX 11.7.10 (Big Sur)",
+    "references": [
+      "URL-https://taomm.org/vol1/pdfs/CH%202%20Persistence.pdf",
+      "URL-https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
+      "ATT&CK-T1647"
+    ],
+    "platform": "OSX,Python,Unix",
+    "arch": "",
+    "rport": null,
+    "autofilter_ports": [],
+    "autofilter_services": [],
+    "targets": [
+      "Mac OS X x64 (Native Payload)",
+      "Mac OS X x86 (Native Payload for 10.14 and earlier)",
+      "Mac OS X Apple Sillicon",
+      "Python payload",
+      "Command payload"
+    ],
+    "mod_time": "2025-09-23 16:59:26 +0000",
+    "path": "/modules/exploits/osx/persistence/launch_plist.rb",
+    "is_install_path": true,
+    "ref_name": "osx/persistence/launch_plist",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session",
+        "event-dependent"
+      ],
+      "SideEffects": [
+        "artifacts-on-disk",
+        "config-changes",
+        "screen-effects"
+      ]
+    },
+    "session_types": [
+      "shell",
+      "meterpreter"
+    ],
+    "needs_cleanup": null,
+    "actions": []
+  },
   "exploit_osx/rtsp/quicktime_rtsp_content_type": {
     "name": "MacOS X QuickTime RTSP Content-Type Overflow",
     "fullname": "exploit/osx/rtsp/quicktime_rtsp_content_type",