Dean Welch <dean_welch@rapid7.com>
Source-scoped identity with 2 associated PoCs and 1 linked vulnerability.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitSSH Key Persistence
Metasploit exploitby h00die <mike@shorebreaksecurity.com>Added to Metasploit 2025-12-19ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that adds an SSH public key to a target user's authorized_keys file to establish persistent remote access. It can generate a new keypair or use a provided public key, and attempts to enable PubkeyAuthentication in sshd_config if disabled.
Backdoor review
No backdoor observed in reviewed code
The module adds an SSH public key to authorized_keys files for persistence. It reads and writes SSH configuration and key files, generates keypairs, stores private keys as loot, and creates credentials. All behavior is consistent with the documented purpose of establishing SSH key-based persistence. No concealed, deceptive, or unrelated harmful actions were observed.
Classification basis and observed behavior
Classification basis
The module's primary purpose is to write an attacker-controlled SSH public key to the target's authorized_keys file, enabling persistent remote login. This is an active exploitation action, not merely detection or scanning. The module is classified as 'exploit' in the Metasploit framework and its description states it 'will add an SSH key' to allow remote login.
modules/exploits/multi/persistence/ssh_key.rb:8modules/exploits/multi/persistence/ssh_key.rb:25-28modules/exploits/multi/persistence/ssh_key.rb:146-147Requirements
- Requires an existing Metasploit session on the target (shell or meterpreter).
modules/exploits/multi/persistence/ssh_key.rb:40 - Target must have an SSH server installed and configured.
modules/exploits/multi/persistence/ssh_key.rb:79
Observed behavior
- Generates a new 4096-bit RSA keypair if no public key is provided, and stores the private key as loot.
modules/exploits/multi/persistence/ssh_key.rb:127-131 - Appends the public key to the target user's authorized_keys file.
modules/exploits/multi/persistence/ssh_key.rb:146-147 - Attempts to enable PubkeyAuthentication in sshd_config if it is disabled or missing, and restarts the SSH service.
modules/exploits/multi/persistence/ssh_key.rb:208-219 - Sets restrictive file permissions on the authorized_keys file and optionally changes ownership.
modules/exploits/multi/persistence/ssh_key.rb:105-118
Behaviors behind the backdoor verdict
Observables
- File Write
- Payload withheldAppends a public key to authorized_keys files to enable SSH login.
modules/exploits/multi/persistence/ssh_key.rb:147 - Key Generation
- Payload withheldGenerates a new RSA keypair if no public key is provided.
modules/exploits/multi/persistence/ssh_key.rb:128 - Credential Storage
- Payload withheldStores the generated private key as loot and creates a credential in the database for later use.
modules/exploits/multi/persistence/ssh_key.rb:130modules/exploits/multi/persistence/ssh_key.rb:167 - Configuration Modification
- Payload withheldModifies sshd_config to enable public key authentication if disabled.
modules/exploits/multi/persistence/ssh_key.rb:212-213 - Service Restart
- Payload withheldRestarts the SSH service to apply configuration changes.
modules/exploits/multi/persistence/ssh_key.rb:215-218
What the analysis did not establish
- Evidence is limited to the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- No runtime behavior or execution context is provided; analysis is based solely on static code review.
- Only the module source is reviewed; framework mixins and libraries are not expanded, but the module's own logic shows no backdoor behavior.
- Binary files are not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.