Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add persistence module for linux and osx #629

Closed
wants to merge 4 commits into from

Conversation

alexmaloteaux
Copy link
Contributor

This patch will create a pesistence mixin shared between osx / linux ans win persistence post module.

For Osx , the persistence is done through launchd by adding a crafted plist file in /Users/username/Library/LaunchAgents for normal user or /Library/LaunchDaemons for root. Keepalive is a feature of launchd

For Linux there is 4 differents methods :

  1. Crontab : this method is the recommended one and will add a @reboot entry in the user crontab config while keeping previous configuration.
  2. Autostart : This method works only if Xorg is detected. For normal user, it will add a desktop file in ~/.config/autostart and for root /etc/xdg/autostart will be used.
  3. INIT : This method will add en entry in /etc/rc.local (only root)
  4. Profile : This method will add en entry in the user shell profile file (bashrc, zshrc , cshrc ....).

Keepalive is done through a bashscript.

@jlee-r7
Copy link
Contributor

jlee-r7 commented Jul 21, 2012

All of the payload creation and handler stuff can be taken care of by the framework if you make this an Exploit::Local

#-------------------------------------------------------------------------------
def log_file(log_path = nil)
#Get hostname
host = session.sys.config.sysinfo["Computer"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should just be sysinfo which is a method defined on Post that caches the result, so multiple uses in the same module don't have to make unnecessary requests.

@alexmaloteaux
Copy link
Contributor Author

Hi jlee-r7

  1. All of the payload creation and handler stuff can be taken care of by the framework if you make this an Exploit::Local
    => I did no changed anything, it is the same methoid as it was in windows/persistences for month , just moved it to a mixin as seen with hdm

  2. this should just be sysinfo which is a method defined on Post that caches the result, so multiple uses in the same module don't have to make unnecessary requests. => again , this has just been moved from windows/persistence to the mixin and was implemented like this for month , it is used only by windows atm

  3. already implemented in Post::File => ha nice will use those then an change it in a commit

  4. This will not work as expected when Metasploit is running on Windows. => it is defined in lib/msf/port/unix so i don't think windows post will use this mixin

5)Copy-paste comment => you have tiger eyes :) , this comment will be removed

@alexmaloteaux
Copy link
Contributor Author

Have removed the comment and used the file/directory_exist method from post::File

For other remarks, it was like this for month and just moved to persistence mixin so may be better to use it that way.

Best Regards

@jlee-r7
Copy link
Contributor

jlee-r7 commented Aug 21, 2012

What I meant with the Exploit::Local comment was that this should not be a Post module. It uses a payload, so therefore it should be an exploit. The windows version was created before Exploit::Local was useful, so it gets a pass until I have time to port it.

@todb-r7
Copy link

todb-r7 commented Nov 6, 2012

Looks like @alexmaloteaux has abandoned this pull request -- no movement on a month, and the PR now has merge conflicts due to drift. Closing this out -- please reopen when you're ready to work on this again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants