Cale Black
Source-scoped identity with 2 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitService SystemD Persistence
Metasploit exploitby h00die <mike@shorebreaksecurity.com>Added to Metasploit 2025-09-09ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that establishes persistence on a Linux system by creating a systemd service that executes a payload. It writes a backdoor executable or shell script, creates a systemd service file pointing to it, enables the service, and starts it.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that writes a user-supplied payload to disk and creates a systemd service to execute it. All behavior is consistent with documented post-exploitation persistence; no concealed, deceptive, or unrelated harmful actions were observed.
Classification basis and observed behavior
Classification basis
The module writes a backdoor payload and a systemd service file, then enables and starts the service to execute the payload. This is active exploitation to establish persistence, not merely scanning or detection.
modules/exploits/linux/persistence/init_systemd.rb:106-118modules/exploits/linux/persistence/init_systemd.rb:154-175Requirements
- Requires an existing Metasploit session on the target (shell or meterpreter).
modules/exploits/linux/persistence/init_systemd.rb:66 - Requires write access to a directory on the target filesystem.
modules/exploits/linux/persistence/init_systemd.rb:93-94 - Target system must use systemd (systemctl command must exist).
modules/exploits/linux/persistence/init_systemd.rb:95
Observed behavior
- Writes a payload executable or shell script to a writable directory on the target.
modules/exploits/linux/persistence/init_systemd.rb:120-135 - Creates a systemd service unit file that executes the payload on startup and restarts it automatically.
modules/exploits/linux/persistence/init_systemd.rb:137-152 - Enables and starts the malicious systemd service to achieve persistence.
modules/exploits/linux/persistence/init_systemd.rb:169-174
Behaviors behind the backdoor verdict
Observables
- Payload Execution
- Payload withheldThe service file executes the attacker-chosen payload, which is the stated purpose of the persistence module.
modules/exploits/linux/persistence/init_systemd.rb:148modules/exploits/linux/persistence/init_systemd.rb:156-158 - File Write
- Payload withheldThe module drops a payload executable and a systemd unit file, which is expected for a persistence mechanism.
modules/exploits/linux/persistence/init_systemd.rb:125-128modules/exploits/linux/persistence/init_systemd.rb:164 - Service Management
- Payload withheldThe module enables and starts the created service to achieve persistence, which is its documented goal.
modules/exploits/linux/persistence/init_systemd.rb:171-174modules/exploits/linux/persistence/init_systemd.rb:216-221
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The artifact is not executed; classification is based on static analysis of the code's intended behavior.
- Only the module source code was reviewed; the behavior of the framework's generate_payload_exe, write_file, and cmd_exec mixins is not expanded in the evidence.
- The actual payload content is user-supplied and not part of this review.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.