{“lastseen”:”2025-10-24T19:10:47″,”description”:”This module suggests persistence modules that can be used. The modules are suggested based on the architecture and platform that the user has a shell opened as well as the…”,”published”:”2025-10-24T19:01:07″,”modified”:”2025-10-24T19:01:07″,”type”:”metasploit”,”title”:”Persistence Exploit Suggester”,”source”:””,”references”:””,”id”:”MSF:POST-MULTI-RECON-PERSISTENCE_SUGGESTER-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Post\\n\\n include Msf::Auxiliary::Report\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Persistence Exploit Suggester’,\\n ‘Description’ =\\u003e %q{\\n This module suggests persistence modules that can be used.\\n The modules are suggested based on the architecture and platform\\n that the user has a shell opened as well as the available exploits\\n in meterpreter.\\n It’s important to note that not all modules will be checked.\\n Exploits are chosen based on these conditions: session type,\\n platform, architecture, and required default options.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [ ‘h00die’ ],\\n ‘Platform’ =\\u003e all_platforms,\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’, ‘shell’ ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [],\\n ‘Reliability’ =\\u003e [],\\n ‘SideEffects’ =\\u003e []\\n }\\n )\\n )\\n register_options [\\n Msf::OptInt.new(‘SESSION’, [ true, ‘The session to run this module on’ ]),\\n Msf::OptBool.new(‘SHOWDESCRIPTION’, [true, ‘Displays a detailed description for the available exploits’, false])\\n ]\\n\\n register_advanced_options(\\n [\\n # most linux persistence modules are arch-cmd but for payload purposes only\\n # but usually we end up with a meterpreter session, thus making these invalid\\n # so disable this check by default\\n Msf::OptBool.new(‘ValidateArch’, [true, ‘Validate architecture’, false]),\\n Msf::OptBool.new(‘ValidatePlatform’, [true, ‘Validate platform’, true]),\\n Msf::OptBool.new(‘ValidateMeterpreterCommands’, [true, ‘Validate Meterpreter commands’, false]),\\n # https:\/\/github.com\/rapid7\/rex-text\/blob\/a72151d409cd812978f63ad0c330efbc8f44b977\/lib\/rex\/text\/color.rb#L13\\n Msf::OptString.new(‘Colors’, [false, ‘Valid, Invalid and Ignored colors for module checks (unset to disable)’, ‘grn\/red\/blu’])\\n ]\\n )\\n end\\n\\n def valid_colors?(color_str = datastore[‘Colors’])\\n tokens = color_str.split(‘\/’)\\n tokens.each do |tok|\\n print_warning \\”#{tok} is unlikely to have any functionality for printing colors.\\” if tok == ‘clr’\\n\\n unless Rex::Text::Color::SUPPORTED_FORMAT_CODES.include?(\\”%#{tok}\\”)\\n print_error \\”#{tok} is NOT valid color. Please see https:\/\/github.com\/rapid7\/rex-text\/blob\/a72151d409cd812978f63ad0c330efbc8f44b977\/lib\/rex\/text\/color.rb#L13 for valid color options\\”\\n return false\\n end\\n end\\n true\\n end\\n\\n def all_platforms\\n Msf::Module::Platform.subclasses.collect { |c| c.realname.downcase }\\n end\\n\\n def session_arch\\n # Prefer calling native arch when available, as most LPEs will require this (e.g. x86, x64) as opposed to Java\/Python Meterpreter’s values (e.g. Java, Python)\\n session.respond_to?(:native_arch) ? session.native_arch : session.arch\\n end\\n\\n def is_module_arch?(mod)\\n mod_arch = mod.target.arch || mod.arch\\n mod_arch.include?(session_arch)\\n rescue StandardError =\\u003e e\\n print_error \\”Failed to check module arch for #{mod.fullname} =\\u003e #{e}\\”\\n end\\n\\n def is_module_wanted?(mod)\\n mod[:result][:incompatibility_reasons].empty?\\n end\\n\\n def is_session_type?(mod)\\n # There are some modules that do not define any compatible session types.\\n # We could assume that means the module can run on all session types,\\n # Or we could consider that as incorrect module metadata.\\n mod.session_types.include?(session.type)\\n end\\n\\n def is_module_platform?(mod)\\n return false if mod.target.nil?\\n\\n platform_obj = Msf::Module::Platform.find_platform session.platform\\n\\n module_platforms = mod.target.platform ? mod.target.platform.platforms : mod.platform.platforms\\n module_platforms.include? platform_obj\\n rescue ArgumentError =\\u003e e\\n # When not found, find_platform raises an ArgumentError\\n elog(‘Could not find a platform’, error: e)\\n return false\\n end\\n\\n def has_required_module_options?(mod)\\n get_all_missing_module_options(mod).empty?\\n end\\n\\n def get_all_missing_module_options(mod)\\n missing_options = []\\n mod.options.each_pair do |option_name, option|\\n missing_options \\u003c\\u003c option_name if option.required \\u0026\\u0026 option.default.nil? \\u0026\\u0026 mod.datastore[option_name].blank?\\n end\\n missing_options\\n end\\n\\n def valid_incompatibility_reasons(mod, verify_reasons)\\n # As we can potentially ignore some `reasons` (e.g. accepting arch values which are, on paper, not compatible),\\n # this keeps track of valid reasons why we will not consider the module that we are evaluating to be valid.\\n valid_reasons = []\\n valid_reasons \\u003c\\u003c \\”Missing required module options (#{get_all_missing_module_options(mod).join(‘. ‘)})\\” unless verify_reasons[:has_required_module_options]\\n\\n incompatible_opts = []\\n incompatible_opts \\u003c\\u003c ‘architecture’ unless verify_reasons[:is_module_arch]\\n incompatible_opts \\u003c\\u003c ‘platform’ unless verify_reasons[:is_module_platform]\\n incompatible_opts \\u003c\\u003c ‘session type’ unless verify_reasons[:is_session_type]\\n valid_reasons \\u003c\\u003c \\”Not Compatible (#{incompatible_opts.join(‘, ‘)})\\” if incompatible_opts.any?\\n\\n valid_reasons \\u003c\\u003c ‘Missing\/unloadable Meterpreter commands’ if verify_reasons[:missing_meterpreter_commands].any?\\n valid_reasons\\n end\\n\\n def set_module_options(mod)\\n ignore_list = [‘ACTION’, ‘TARGET’].freeze\\n datastore.each_pair do |k, v|\\n mod.datastore[k] = v unless ignore_list.include?(k.upcase)\\n end\\n if !mod.datastore[‘SESSION’] \\u0026\\u0026 session.present?\\n mod.datastore[‘SESSION’] = session.sid\\n end\\n end\\n\\n def set_module_target(mod)\\n session_platform = Msf::Module::Platform.find_platform(session.platform)\\n target_index = mod.targets.find_index do |target|\\n # If the target doesn’t define its own compatible platforms or architectures, default to the parent (module) values.\\n target_platforms = target.platform\\u0026.platforms || mod.platform.platforms\\n target_architectures = target.arch || mod.arch\\n\\n target_platforms.include?(session_platform) \\u0026\\u0026 target_architectures.include?(session_arch)\\n end\\n mod.datastore[‘Target’] = target_index if target_index\\n end\\n\\n def setup\\n return unless session\\n\\n print_status \\”Collecting persistence modules for #{session.session_type}…\\”\\n\\n setup_validation_options\\n if valid_colors?\\n setup_color_options\\n else\\n fail_with(Failure::BadConfig, ‘Colors options set incorrectly’)\\n end\\n\\n # Collects persistence modules into an array\\n @persistence_modules = []\\n exploit_refnames = framework.exploits.module_refnames\\n exploit_refnames.each_with_index do |name, index|\\n print \\”%bld%blu[*]%clr Collecting exploit #{index + 1} \/ #{exploit_refnames.count}\\\\r\\”\\n next unless name.include? ‘\/persistence\/’\\n\\n mod = framework.exploits.create name\\n next unless mod\\n\\n set_module_options mod\\n set_module_target mod\\n verify_result = verify_mod(mod)\\n @persistence_modules \\u003c\\u003c { module: mod, result: verify_result } if verify_result[:has_check]\\n end\\n end\\n\\n def verify_mod(mod)\\n return { has_check: false } unless mod.is_a?(Msf::Exploit::Local) \\u0026\\u0026 mod.has_check?\\n\\n result = {\\n has_check: true,\\n is_module_platform: (@validate_platform ? is_module_platform?(mod) : true),\\n is_module_arch: (@validate_arch ? is_module_arch?(mod) : true),\\n has_required_module_options: has_required_module_options?(mod),\\n missing_meterpreter_commands: (@validate_meterpreter_commands \\u0026\\u0026 session.type == ‘meterpreter’) ? meterpreter_session_incompatibility_reasons(session) : [],\\n is_session_type: is_session_type?(mod)\\n }\\n result[:incompatibility_reasons] = valid_incompatibility_reasons(mod, result)\\n result\\n end\\n\\n def setup_validation_options\\n @validate_arch = datastore[‘ValidateArch’]\\n @validate_platform = datastore[‘ValidatePlatform’]\\n @validate_meterpreter_commands = datastore[‘ValidateMeterpreterCommands’]\\n end\\n\\n def setup_color_options\\n @valid_color, @invalid_color, @ignored_color =\\n (datastore[‘Colors’] || ”).split(‘\/’)\\n\\n @valid_color = \\”%#{@valid_color}\\” unless @valid_color.blank?\\n @invalid_color = \\”%#{@invalid_color}\\” unless @invalid_color.blank?\\n @ignored_color = \\”%#{@ignored_color}\\” unless @ignored_color.blank?\\n end\\n\\n def show_found_exploits\\n unless datastore[‘VERBOSE’]\\n print_status \\”#{@persistence_modules.length} exploit checks are being tried…\\”\\n return\\n end\\n\\n vprint_status \\”The following #{@persistence_modules.length} exploit checks are being tried:\\”\\n @persistence_modules.each do |x|\\n vprint_status x[:module].fullname\\n end\\n end\\n\\n def run\\n runnable_exploits = @persistence_modules.select { |mod| is_module_wanted?(mod) }\\n if runnable_exploits.empty?\\n print_error ‘No suggestions available.’\\n vprint_line\\n vprint_session_info\\n vprint_status unwanted_modules_table(@persistence_modules.reject { |mod| is_module_wanted?(mod) })\\n return\\n end\\n\\n show_found_exploits\\n results = runnable_exploits.map.with_index do |mod, index|\\n print \\”%bld%blu[*]%clr Running check method for exploit #{index + 1} \/ #{runnable_exploits.count}\\\\r\\”\\n begin\\n checkcode = mod[:module].check\\n rescue StandardError =\\u003e e\\n elog(\\”#Local Persistence Suggester failed with: #{e.class} when using #{mod[:module].shortname}\\”, error: e)\\n vprint_error \\”Check with module #{mod[:module].fullname} failed with error #{e.class}\\”\\n next { module: mod[:module], errors: [‘The check raised an exception.’] }\\n end\\n\\n if checkcode.nil?\\n vprint_error \\”Check failed with #{mod[:module].fullname} for unknown reasons\\”\\n next { module: mod[:module], errors: [‘The check failed for unknown reasons.’] }\\n end\\n\\n # See def is_check_interesting?\\n unless is_check_interesting? checkcode\\n vprint_status \\”#{mod[:module].fullname}: #{checkcode.message}\\”\\n next { module: mod[:module], errors: [checkcode.message] }\\n end\\n\\n # Prints the full name and the checkcode message for the exploit\\n print_good \\”#{mod[:module].fullname}: #{checkcode.message}\\”\\n\\n # If the datastore option is true, a detailed description will show\\n if datastore[‘SHOWDESCRIPTION’]\\n # Formatting for the description text\\n Rex::Text.wordwrap(Rex::Text.compress(mod[:module].description), 2, 70).split(\/\\\\n\/).each do |line|\\n print_line line\\n end\\n end\\n\\n next { module: mod[:module], checkcode: checkcode.message }\\n end\\n\\n print_line\\n print_status valid_modules_table(results)\\n\\n vprint_line\\n vprint_session_info\\n vprint_status unwanted_modules_table(@persistence_modules.reject { |mod| is_module_wanted?(mod) })\\n\\n report_data = {}\\n results.each do |result|\\n report_data[result[:module].fullname] = result[:checkcode] if result[:checkcode]\\n end\\n\\n report_note({\\n host: session.session_host,\\n type: ‘persistence.suggested_module’,\\n data: report_data\\n })\\n end\\n\\n def valid_modules_table(results)\\n name_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new\\n check_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new\\n\\n # Split all the results by their checkcode.\\n # We want the modules that returned a checkcode to be at the top.\\n checkcode_rows, without_checkcode_rows = results.partition { |result| result[:checkcode] }\\n rows = (checkcode_rows + without_checkcode_rows).map.with_index do |result, index|\\n color = result[:checkcode] ? @valid_color : @invalid_color\\n check_res = result.fetch(:checkcode) { result[:errors].join(‘. ‘) }\\n name_styler.merge!({ result[:module].fullname =\\u003e color })\\n check_styler.merge!({ check_res =\\u003e color })\\n\\n [\\n index + 1,\\n result[:module].fullname,\\n result[:checkcode] ? ‘Yes’ : ‘No’,\\n check_res\\n ]\\n end\\n\\n Rex::Text::Table.new(\\n ‘Header’ =\\u003e \\”Valid modules for session #{session.sid}:\\”,\\n ‘Indent’ =\\u003e 1,\\n ‘Columns’ =\\u003e [ ‘#’, ‘Name’, ‘Potentially Vulnerable?’, ‘Check Result’ ],\\n ‘SortIndex’ =\\u003e -1,\\n ‘WordWrap’ =\\u003e false, # Don’t wordwrap as it messes up coloured output when it is broken up into more than one line\\n ‘ColProps’ =\\u003e {\\n ‘Name’ =\\u003e {\\n ‘Stylers’ =\\u003e [name_styler]\\n },\\n ‘Potentially Vulnerable?’ =\\u003e {\\n ‘Stylers’ =\\u003e [::Msf::Ui::Console::TablePrint::CustomColorStyler.new({ ‘Yes’ =\\u003e @valid_color, ‘No’ =\\u003e @invalid_color })]\\n },\\n ‘Check Result’ =\\u003e {\\n ‘Stylers’ =\\u003e [check_styler]\\n }\\n },\\n ‘Rows’ =\\u003e rows\\n )\\n end\\n\\n def unwanted_modules_table(unwanted_modules)\\n arch_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new\\n platform_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new\\n session_type_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new\\n\\n rows = unwanted_modules.map.with_index do |mod, index|\\n begin\\n platforms = mod[:module].target.platform\\u0026.platforms\\u0026.any? ? mod[:module].target.platform.platforms : mod[:module].platform.platforms\\n rescue NoMethodError\\n platforms = nil\\n end\\n platforms ||= []\\n begin\\n arch = mod[:module].target.arch\\u0026.any? ? mod[:module].target.arch : mod[:module].arch\\n rescue NoMethodError\\n arch = nil\\n end\\n arch ||= []\\n\\n arch.each do |a|\\n if a != session_arch\\n if @validate_arch\\n color = @invalid_color\\n else\\n color = @ignored_color\\n end\\n else\\n color = @valid_color\\n end\\n\\n arch_styler.merge!({ a.to_s =\\u003e color })\\n end\\n\\n platforms.each do |module_platform|\\n if module_platform != ::Msf::Module::Platform.find_platform(session.platform)\\n if @validate_platform\\n color = @invalid_color\\n else\\n color = @ignored_color\\n end\\n else\\n color = @valid_color\\n end\\n\\n platform_styler.merge!({ module_platform.realname =\\u003e color })\\n end\\n\\n mod[:module].session_types.each do |session_type|\\n color = session_type == session.type ? @valid_color : @invalid_color\\n session_type_styler.merge!(session_type.to_s =\\u003e color)\\n end\\n\\n [\\n index + 1,\\n mod[:module].fullname,\\n mod[:result][:incompatibility_reasons].join(‘. ‘),\\n platforms.any? ? platforms.map(\\u0026:realname).sort.join(‘, ‘) : ‘No defined platforms’,\\n arch.any? ? arch.sort.join(‘, ‘) : ‘No defined architectures’,\\n mod[:module].session_types.any? ? mod[:module].session_types.sort.join(‘, ‘) : ‘No defined session types’\\n ]\\n end\\n\\n Rex::Text::Table.new(\\n ‘Header’ =\\u003e \\”Incompatible modules for session #{session.sid}:\\”,\\n ‘Indent’ =\\u003e 1,\\n ‘Columns’ =\\u003e [ ‘#’, ‘Name’, ‘Reasons’, ‘Platform’, ‘Architecture’, ‘Session Type’ ],\\n ‘WordWrap’ =\\u003e false,\\n ‘ColProps’ =\\u003e {\\n ‘Architecture’ =\\u003e {\\n ‘Stylers’ =\\u003e [arch_styler]\\n },\\n ‘Platform’ =\\u003e {\\n ‘Stylers’ =\\u003e [platform_styler]\\n },\\n ‘Session Type’ =\\u003e {\\n ‘Stylers’ =\\u003e [session_type_styler]\\n }\\n },\\n ‘Rows’ =\\u003e rows\\n )\\n end\\n\\n def vprint_session_info\\n vprint_status ‘Current Session Info:’\\n vprint_status \\” Session Type: #{session.type}\\”\\n vprint_status \\” Architecture: #{session_arch}\\”\\n vprint_status \\” Platform: #{session.platform}\\”\\n end\\n\\n def is_check_interesting?(checkcode)\\n [\\n Msf::Exploit::CheckCode::Vulnerable,\\n Msf::Exploit::CheckCode::Appears,\\n Msf::Exploit::CheckCode::Detected\\n ].include? checkcode\\n end\\n\\n def print_status(msg = ”)\\n super(session ? \\”#{session.session_host} – #{msg}\\” : msg)\\n end\\n\\n def print_good(msg = ”)\\n super(session ? \\”#{session.session_host} – #{msg}\\” : msg)\\n end\\n\\n def print_error(msg = ”)\\n super(session ? \\”#{session.session_host} – #{msg}\\” : msg)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/post\/multi\/recon\/persistence_suggester.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/post\/multi\/recon\/persistence_suggester\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-24T19:10:47″,”description”:”This module suggests persistence modules that can be used. The modules are suggested based on the architecture and platform that the user has a shell…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-23215","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n