deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Notepad++ Plugin Persistence
Type: exploit
Path: modules/exploits/windows/persistence/notepadpp_plugin.rb
Disclosure date: 2005-12-11
References: URL-https://www.cybereason.com/blog/threat-analysis-report-abusing-notepad-plugins-for-evasion-and-persistence

Description:
This module create persistence by adding a malicious plugin to Notepad++, as it blindly loads and executes DLL from its plugin directory on startup, meaning that the payload will be executed every time Notepad++ is launched.

Check method (fingerprinting):
@plugin_dir = get_plugin_dir
    return CheckCode::Safe('Notepad++ is probably not present') unless directory?(@plugin_dir)

    # borrowed from startup folder persistence
    begin
      # windows only ps payloads have writable? so try that first
      return CheckCode::Safe("Unable to write to #{@plugin_dir}") unless writable?(@plugin_dir)
    rescue RuntimeError
      filename = @plugin_dir + '\\' + Rex::Text.rand_text_alpha((rand(6..13)))
      write_file(filename, '')
      if exists? filename
        rm_f(filename)
      else
        return CheckCode::Safe("Unable to write to #{@plugin_dir}")
      end
    end

    CheckCode::Vulnerable('Notepad++ present and plugin folder is writable')
  end
Metasploit Module: Windows Telemetry Persistence
Type: exploit
Path: modules/exploits/windows/persistence/telemetry.rb
Disclosure date: 2023-11-06
References: URL-https://pentestlab.blog/2023/11/06/persistence-windows-telemetry/

Description:
This persistence mechanism installs a new telemetry provider for windows. If telemetry is turned on,
          when the scheduled task launches, it will execute the telemetry provider and execute our payload
          with system permissions.

Check method (fingerprinting):
return Msf::Exploit::CheckCode::Safe('System does not have powershell') unless registry_enumkeys('HKLM\\SOFTWARE\\Microsoft\\').include?('PowerShell')

    vprint_good('Powershell detected on system')

    # Check if the scheduled task is enabled (aka it has a next run time)
    # determine if we have Appraiser or Appraiser Exp, its not clear when the change happened, but my windows 11 uses Exp and windows 10 doesn't
    ['Microsoft Compatibility Appraiser Exp', 'Microsoft Compatibility Appraiser'].each do |appraiser_name|
      @appraiser_name = appraiser_name
      @next_run_time = cmd_exec(%(schtasks /query /tn "\\Microsoft\\Windows\\Application Experience\\#{appraiser_name}" /fo list /v))
      break unless @next_run_time.include? 'ERROR'
    end
    print_status("Appraiser name found: #{@appraiser_name}")
    @next_run_time = begin
      @next_run_time.match(/Next Run Time:\s+(.+?)\r/)[1]
    rescue StandardError
      nil
    end
    return Msf::Exploit::CheckCode::Safe('Scheduled task for telemetry is disabled') if @next_run_time.strip.end_with?('N/A')

    print_good("Next scheduled runtime: #{@next_run_time.strip}")

    # test write to see if we have access
    rand = Rex::Text.rand_text_alpha((rand(6..13)))

    vprint_status("Checking registry write access to: #{regkey}\\#{rand}")
    return Msf::Exploit::CheckCode::Safe("Unable to write to registry path #{regkey}\\#{rand}") if registry_createkey("#{regkey}\\#{rand}").nil?

    registry_deletekey("#{regkey}\\#{ran
Metasploit Module: Windows Persistence Bits Job
Type: exploit
Path: modules/exploits/windows/persistence/bits.rb
Disclosure date: 2001-10-01
References: URL-https://pentestlab.blog/2019/10/30/persistence-bits-jobs/, URL-https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin, URL-https://learn.microsoft.com/en-us/windows/win32/bits/life-cycle-of-a-bits-job

Description:
This module establishes persistence through a BITS job that
          downloads and executes a payload. Background Intelligent Transfer Service
          (BITS) is a Windows service for transferring files in the background
          using idle network bandwidth. BITS jobs are persistent and will resume
          across reboots until completed or cancelled.

          BITS does not include a timing mechanism for when jobs are run, so we control that
          in how we respond to the HTTP requests from the BITS client. This avoids needing
          to set up an external trigger to start the job like a scheduled task or similar.

          Similarily, BITS jobs are somewhat clock agnostic, so while we can set some
          time parameters, the aren't a guarantee of when the job will actually run.
          Jobs that we've idled via HTTP server response will have a "CONNECTING" status.

          BITS is fickle about the HTTP responses it expects, so we have to be precise in
          how the server responds. For a HEAD request we need to send back a correct
          Content-Length header matching the payload size, but with no body. For GET requests
          we need to handle byte range requests properly (althought not always used),
          sending back the appropriate
          Content-Range headers. If we respond incorrectly BITS may error out or retry
          in unexpected ways. However, we can trick BITS into not getting the payload until
          we want by responding to the GET requests with no body (aka how we responded to
          the HEAD requests) until our delay time has reached.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)

    Msf::Exploit::CheckCode::Vulnerable('Likely exploitable')
  end
Metasploit Module: Windows Registry Active Setup Persistence
Type: exploit
Path: modules/exploits/windows/persistence/registry_active_setup.rb
Disclosure date: 2015-12-01
References: URL-https://hadess.io/the-art-of-windows-persistence/

Description:
This module will register a payload to run via the Active Setup mechanism in Windows.
          Active Setup is a Windows feature that runs once per user at login.
          It triggers in a user context, losing privileges from admin to user.

          Active Setup will open a popup box with "Personalized Settings" and the text
          "Setting up personalized settings for: <SETUP_NAME>". However
          this won't occur until the login screen has exited (but before the desktop
          is loaded), and our execution is extremely fast so likely the user will not
          see it.

Check method (fingerprinting):
return Msf::Exploit::CheckCode::Safe('System does not have powershell') unless registry_enumkeys('HKLM\\SOFTWARE\\Microsoft').include?('PowerShell')

    vprint_good('Powershell detected on system')

    # test write to see if we have access
    rand = Rex::Text.rand_guid

    vprint_status("Checking registry write access to: #{regkey}\\#{rand}")
    return Msf::Exploit::CheckCode::Safe("Unable to write to registry path #{regkey}\\#{rand}") if registry_createkey("#{regkey}\\#{rand}").nil?

    registry_deletekey("#{regkey}\\#{rand}")

    Msf::Exploit::CheckCode::Vulnerable('Registry writable')
  end
Metasploit Module: Windows Registry Only Persistence
Type: exploit
Path: modules/exploits/windows/persistence/registry.rb
Disclosure date: 2015-07-01
References: URL-https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys, URL-https://pentestlab.blog/2019/10/01/persistence-registry-run-keys/

Description:
This module will install a payload that is executed during boot.
          It will be executed either at user logon or system startup via the registry
          value in "CurrentVersion\Run" or "RunOnce" (depending on privilege and selected method).
          The payload will be installed completely in registry.

Check method (fingerprinting):
return Msf::Exploit::CheckCode::Safe('System does not have powershell') unless registry_enumkeys('HKLM\\SOFTWARE\\Microsoft').include?('PowerShell')

    vprint_good('Powershell detected on system')

    # test write to see if we have access
    root_path = get_root_path
    rand = Rex::Text.rand_text_alphanumeric(15)

    vprint_status("Checking registry write access to: #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\#{regkey}\\#{rand}")
    return Msf::Exploit::CheckCode::Safe("Unable to write to registry path #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\#{regkey}") if registry_createkey("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{rand}").nil?

    registry_deletekey("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\#{regkey}\\#{rand}")

    Msf::Exploit::CheckCode::Vulnerable('Registry writable')
  end
Metasploit Module: Assistive Technologies Persistence
Type: exploit
Path: modules/exploits/windows/persistence/assistive_technology.rb
Platform: win
Disclosure date: 2016-07-22
Authors: h00die
References: URL-https://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/, URL-https://msdn.microsoft.com/ru-ru/library/windows/desktop/bb879984.aspx

Description:
This module achieves persistence by registering a custom Assistive Technology (AT) in the Windows registry.
          Then it configures the system to launch the AT executable during user logon or desktop switch (such as with
          an admin prived program).
          Requires Windows 8 or higher and administrative privileges.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)

    version = get_version_info
    return CheckCode::Safe('Only supported on Windows 8 and above') unless version.build_number >= Msf::WindowsVersion::Win8

    return CheckCode::Safe('You have admin rights to run this Module') unless is_admin?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: Windows Persistence via UserInitMprLogonScript
Type: exploit
Path: modules/exploits/windows/persistence/userinit_mpr_logon_script.rb
Disclosure date: 2015-07-01
Authors: Nayera
References: URL-https://hadess.io/the-art-of-windows-persistence/

Description:
This module establishes persistence by setting the UserInitMprLogonScript
          value in HKCU\Environment. During user logon, userinit.exe checks this value
          and executes the specified command or binary.

          The module writes a payload executable to disk and points
          UserInitMprLogonScript to that payload.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%')

    return CheckCode::Safe("#{writable_dir} does not exist") unless exists?(writable_dir)

    test_name = Rex::Text.rand_text_alpha(8)
    test_value = Rex::Text.rand_text_alpha(8)
    return CheckCode::Safe("Unable to write to registry path #{regkey}") unless registry_setvaldata(regkey, test_name, test_value, 'REG_SZ')

    registry_deleteval(regkey, test_name)

    CheckCode::Vulnerable('Registry path is writable')
  end
Metasploit Module: Powershell Profile Persistence
Type: exploit
Path: modules/exploits/windows/persistence/powershell_profile.rb
Disclosure date: 2019-11-05
References: URL-https://pentestlab.blog/2019/11/05/persistence-powershell-profile/

Description:
This module establishes persistence by modifying a PowerShell profile script, which is automatically
          executed when PowerShell starts. The module supports multiple profile scopes (current user or all users)
          and safely backs up any existing profile prior to modification, enabling clean removal by restoring the original file.

Check method (fingerprinting):
return Msf::Exploit::CheckCode::Safe('System does not have powershell') unless registry_enumkeys('HKLM\\SOFTWARE\\Microsoft').include?('PowerShell')

    unless policy_allows_execution?
      if datastore['EXECUTIONPOLICY']
        return Msf::Exploit::CheckCode::Appears("Powershell execution policy for CurrentUser (#{@policies['CurrentUser']}), will attempt to override")
      else
        return Msf::Exploit::CheckCode::Safe("Powershell execution policy for CurrentUser (#{@policies['CurrentUser']}) doesn't allow script execution, try setting EXECUTIONPOLICY")
      end
    end
    vprint_status("Powershell execution policy for CurrentUser (#{@policies['CurrentUser']})")

    CheckCode::Appears('Powershell is installed and exploitable on the target system')
  end
Metasploit Module: LINQPad Deserialization
Type: exploit
Path: modules/exploits/windows/persistence/linqpad_deserialization.rb
Platform: win
Disclosure date: 2024-12-03
References: URL-https://trustedsec.com/blog/discovering-a-deserialization-vulnerability-in-linqpad, CVE-2024-53326
Targets: Windows

Description:
This module exploits a bug in LIQPad up to version 5.48.00. The bug is only exploitable in paid version of software. The core of a bug is cache file containing deserialized data, which attacker can overwrite with malicious payload. The data gets deserialized every time the app restarts.

Check method (fingerprinting):
if !directory?(datastore['Cache_path'])
      return Exploit::CheckCode::Unknown('Cache directory doesn\'t exist')
    elsif !file?(datastore['CACHE_PATH'] + '/autorefcache46.1.dat')
      return Exploit::CheckCode::Unknown('Cannot find cache file')
    elsif file?(datastore['CACHE_PATH'] + '/autorefcache46.2.dat')
      return Exploit::CheckCode::Safe('Contains not vulnerable version of LINQPad')
    else
      return Exploit::CheckCode::Appears('LINQPad and vulnerable cache file present, target possibly exploitable')
    end
  end
Metasploit Module: Windows Registry Persistence via Userinit
Type: exploit
Path: modules/exploits/windows/persistence/registry_userinit.rb
Disclosure date: 2015-07-01
References: URL-https://hadess.io/the-art-of-windows-persistence/

Description:
This module will install a payload that is executed during user logon.
          It writes a payload executable to disk and modifies the Userinit registry value
          in "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" to append the
          payload path, causing it to execute when any user logs in.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)

    return Msf::Exploit::CheckCode::Safe("Unable to read registry path #{regkey} with key Userinit") if registry_getvaldata(regkey, 'Userinit').nil?

    Msf::Exploit::CheckCode::Vulnerable('Registry likely exploitable')
  end
Metasploit Module: Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger
Type: exploit
Path: modules/exploits/windows/persistence/service_for_user/lock_unlock.rb
Platform: win
Disclosure date: 2013-01-02
References: URL-https://web.archive.org/web/[PII_REDACTED]4249/https://www.pentestgeek.com/2013/02/11/scheduled-tasks-with-s4u-and-on-demand-persistence/, URL-https://web.archive.org/web/[PII_REDACTED]2052/http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/, URL-https://web.archive.org/web/[PII_REDACTED]5026/http://msdn.microsoft.com/en-us/magazine/cc188757.aspx

Description:
Creates a scheduled task that will run using service-for-user (S4U).
          This allows the scheduled task to run even as an unprivileged user
          that is not logged into the device. This will result in lower security
          context, allowing access to local resources only. The module
          requires 'Logon as a batch job' permissions (SeBatchLogonRight).

          This triggers on either a lock or unlock of the workstation.

Check method (fingerprinting):
version = get_version_info
    print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesn't exist") unless exists?(writable_dir)
    return CheckCode::Safe('This module only works on Vista/2008 and above') unless version.build_number >= Msf::WindowsVersion::Vista_SP0

    return CheckCode::Appears('Target is likely exploitable')
  end

  ##############################################################
  # Generate name for payload
  # Returns name
Metasploit Module: Windows Service for User (S4U) Scheduled Task Persistence - Schedule Trigger
Type: exploit
Path: modules/exploits/windows/persistence/service_for_user/schedule.rb
Platform: win
Disclosure date: 2013-01-02
References: URL-https://web.archive.org/web/[PII_REDACTED]4249/https://www.pentestgeek.com/2013/02/11/scheduled-tasks-with-s4u-and-on-demand-persistence/, URL-https://web.archive.org/web/[PII_REDACTED]2052/http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/, URL-https://web.archive.org/web/[PII_REDACTED]5026/http://msdn.microsoft.com/en-us/magazine/cc188757.aspx

Description:
Creates a scheduled task that will run using service-for-user (S4U).
          This allows the scheduled task to run even as an unprivileged user
          that is not logged into the device. This will result in lower security
          context, allowing access to local resources only. The module
          requires 'Logon as a batch job' permissions (SeBatchLogonRight).

          Creates a scheduled task to run the payload ever FREQUENCY minutes for
          the duration of EXPIRE_TIME.

Check method (fingerprinting):
version = get_version_info
    print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesn't exist") unless exists?(writable_dir)
    return CheckCode::Safe('This module only works on Vista/2008 and above') unless version.build_number >= Msf::WindowsVersion::Vista_SP0

    return CheckCode::Appears('Target is likely exploitable')
  end

  ##############################################################
  # Generate name for payload
  # Returns name
Metasploit Module: Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger
Type: exploit
Path: modules/exploits/windows/persistence/service_for_user/logon.rb
Platform: win
Disclosure date: 2013-01-02
References: URL-https://web.archive.org/web/[PII_REDACTED]4249/https://www.pentestgeek.com/2013/02/11/scheduled-tasks-with-s4u-and-on-demand-persistence/, URL-https://web.archive.org/web/[PII_REDACTED]2052/http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/, URL-https://web.archive.org/web/[PII_REDACTED]5026/http://msdn.microsoft.com/en-us/magazine/cc188757.aspx

Description:
Creates a scheduled task that will run using service-for-user (S4U).
          This allows the scheduled task to run even as an unprivileged user
          that is not logged into the device. This will result in lower security
          context, allowing access to local resources only. The module
          requires 'Logon as a batch job' permissions (SeBatchLogonRight).

          This triggers on event 4101 which validates the Windows license after logon.

Check method (fingerprinting):
version = get_version_info
    print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesn't exist") unless exists?(writable_dir)
    return CheckCode::Safe('This module only works on Vista/2008 and above') unless version.build_number >= Msf::WindowsVersion::Vista_SP0

    return CheckCode::Appears('Target is likely exploitable')
  end

  ##############################################################
  # Generate name for payload
  # Returns name
Metasploit Module: Windows Service for User (S4U) Scheduled Task Persistence - Event Trigger
Type: exploit
Path: modules/exploits/windows/persistence/service_for_user/event.rb
Platform: win
Disclosure date: 2013-01-02
References: URL-https://web.archive.org/web/[PII_REDACTED]4249/https://www.pentestgeek.com/2013/02/11/scheduled-tasks-with-s4u-and-on-demand-persistence/, URL-https://web.archive.org/web/[PII_REDACTED]2052/http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/, URL-https://web.archive.org/web/[PII_REDACTED]5026/http://msdn.microsoft.com/en-us/magazine/cc188757.aspx, URL-https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx

Description:
Creates a scheduled task that will run using service-for-user (S4U).
          This allows the scheduled task to run even as an unprivileged user
          that is not logged into the device. This will result in lower security
          context, allowing access to local resources only. The module
          requires 'Logon as a batch job' permissions (SeBatchLogonRight).

          This variant uses an event trigger to launch the payload when a
          specified event is logged to the Windows Event Log.

          See documentation for more interesting event trigger ideas.

Check method (fingerprinting):
version = get_version_info
    print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesn't exist") unless exists?(writable_dir)
    return CheckCode::Safe('This module only works on Vista/2008 and above') unless version.build_number >= Msf::WindowsVersion::Vista_SP0

    return CheckCode::Appears('Target is likely exploitable')
  end

  ##############################################################
  # Generate name for payload
  # Returns name
Metasploit Module: WMI Event Subscription Logon Timer Persistence
Type: exploit
Path: modules/exploits/windows/persistence/wmi/wmi_event_subscription_uptime.rb
Platform: win
Disclosure date: 2017-06-06
References: URL-https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf, URL-https://learn-powershell.net/2013/08/14/powershell-and-events-permanent-wmi-event-subscriptions/

Description:
This module will create a permanent WMI event subscription to achieve file-less persistence using an event filter that
          will trigger the payload after the system has a certain uptime. Payloads will trigger every minute until the set end time.

          Additionally a custom command can be specified to run once the trigger is
          activated using the advanced option CustomPsCommand. This module requires administrator level privileges as well as a
          high integrity process. It is also recommended to use staged payloads due to powershell script length limitations.

Check method (fingerprinting):
return CheckCode::Safe('This module requires powershell to run') unless have_powershell?

    return CheckCode::Safe('This module requires admin privs to run') unless is_admin?

    return CheckCode::Safe('This module cannot run as System') if is_system?

    return CheckCode::Safe('This module requires UAC to be bypassed first') unless is_high_integrity?

    uptime = windows_uptime
    vprint_status("System uptime: #{uptime}s")
    return CheckCode::Safe("SYSTEM_UPTIME_START (#{datastore['SYSTEM_UPTIME_START']}) is less than the current system uptime: #{uptime}") if uptime > datastore['SYSTEM_UPTIME_START']
    return CheckCode::Safe("SYSTEM_UPTIME_START (#{datastore['SYSTEM_UPTIME_START']}) must be less than SYSTEM_UPTIME_END: #{datastore['SYSTEM_UPTIME_END']}") if datastore['SYSTEM_UPTIME_START'] > datastore['SYSTEM_UPTIME_END']

    CheckCode::Appears('Likely exploitable')
  end