metasploit-gs/documentation/modules/exploit/linux/local/apt_package_manager_persistence.md

Apt package manager persistence

This module will run a payload when the package manager is used. No handler is ran automatically so you must configure an appropriate exploit/multi/handler to connect. Module creates a pre-invoke hook for APT in apt.conf.d. The Hook name syntax is numeric followed by text.

Testing

1. Exploit a box that uses APT
2. use linux/local/apt_package_manager_persistence
3. set SESSION <id>
4. set PAYLOAD cmd/unix/reverse_python configure the payload as needed
5. exploit

When the system runs apt-get update the payload will launch. You must set handler accordingly.

Options

BACKDOOR_NAME Name of backdoor executable

HOOKNAME Name of pre-invoke hook to be installed in /etc/apt/apt.conf.d/ default is (05new-hook). Pre-invoke hooks name syntax is numeric followed by text.

SESSION The session to run this module on.

Advanced Options

WritableDir Writable directory for backdoor default is (/usr/local/bin/)