Skip to content

Conversation

bcoles
Copy link
Contributor

@bcoles bcoles commented Oct 11, 2025

The exploit/multi/local/periodic_script_persistence module sets an invalid target index within the DefaultTarget option.

'Targets' => [
[ 'OSX', { 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Platform' => 'osx' } ],
[ 'Python', { 'Arch' => ARCH_PYTHON, 'Platform' => 'python' } ],
[ 'Unix', { 'Arch' => ARCH_CMD, 'Platform' => 'unix' } ],
[ 'Bsd', { 'Arch' => [ARCH_X86, ARCH_X64], 'Platform' => 'bsd' }]
],
'DefaultOptions' => {
'DisablePayloadHandler' => true
},
'DefaultTarget' => 4,

Targets are zero-indexed. As such, 4 is an invalid target index.

This caused issues with the Local Exploit Suggester (#20609).

I'm not sure why 4 (presumably 3) was chosen as the default target. This target does not perform automatic targeting and is not a safe default target for all platforms.

This PR removes the default DefaultTarget value, forcing the operator to knowingly and intentionally chose a target.

@github-project-automation github-project-automation bot moved this from Todo to In Progress in Metasploit Kanban Oct 13, 2025
@adfoster-r7 adfoster-r7 merged commit fcb469b into rapid7:master Oct 13, 2025
19 checks passed
@adfoster-r7 adfoster-r7 added the rn-fix release notes fix label Oct 13, 2025
@github-project-automation github-project-automation bot moved this from In Progress to Done in Metasploit Kanban Oct 13, 2025
@adfoster-r7
Copy link
Contributor

Release Notes

Fixes a bug in the exploit/multi/local/periodic_script_persistence module which caused issues for the Local Exploit Suggester

@bcoles bcoles deleted the periodic_script_persistence branch October 13, 2025 22:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants