gardnerapp
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitPeriodic Script Persistence
Metasploit exploitby msutovsky-r7Added to Metasploit 2025-10-13ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that establishes persistence by writing a payload script to the /etc/periodic directory on BSD, OSX, or Arch Linux systems. It requires root privileges and supports multiple target architectures and payload types.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that writes a payload to /etc/periodic. No backdoor, deceptive behavior, or unrelated malicious activity was observed. The module's purpose is clearly stated and its actions are consistent with that purpose.
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that writes a payload to a periodic execution directory, achieving persistence. It includes a check method to verify writability and an install_persistence method that deploys the payload, which is the core behavior of an exploit.
modules/exploits/multi/persistence/periodic_script.rb:6modules/exploits/multi/persistence/periodic_script.rb:63-69modules/exploits/multi/persistence/periodic_script.rb:85-103Requirements
- Requires an existing session (shell or meterpreter) with root privileges.
modules/exploits/multi/persistence/periodic_script.rb:24 - Requires the /etc/periodic directory to be writable.
modules/exploits/multi/persistence/periodic_script.rb:66
Observed behavior
- Checks if the target /etc/periodic subdirectory is writable.
modules/exploits/multi/persistence/periodic_script.rb:63-69 - Writes a payload script to the periodic directory and makes it executable.
modules/exploits/multi/persistence/periodic_script.rb:71-83 - Generates a payload binary or script based on the selected target architecture and writes it to the periodic directory.
modules/exploits/multi/persistence/periodic_script.rb:85-103
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Payload withheldThe module's stated purpose is to achieve persistence by writing a script to the periodic directory. The code in write_periodic_script (lines 71-83) and install_persistence (lines 85-103) implements this behavior directly.
modules/exploits/multi/persistence/periodic_script.rb:22-24modules/exploits/multi/persistence/periodic_script.rb:71-83modules/exploits/multi/persistence/periodic_script.rb:85-103 - Payload Generation
- Payload withheldThe module generates payloads using the framework's standard methods, which are expected for a Metasploit exploit module. No custom or obfuscated payloads are embedded.
modules/exploits/multi/persistence/periodic_script.rb:95modules/exploits/multi/persistence/periodic_script.rb:97modules/exploits/multi/persistence/periodic_script.rb:99 - Privilege Requirement
- Payload withheldThe module description (line 24) and check method (lines 63-69) indicate root privileges are needed. This is consistent with the intended persistence mechanism and not a hidden malicious requirement.
modules/exploits/multi/persistence/periodic_script.rb:24modules/exploits/multi/persistence/periodic_script.rb:63-69
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not included.
- The module's actual behavior at runtime, including payload generation and execution, is not verified.
- Only the module source code was reviewed; framework mixins, libraries, and external payloads are not expanded and were not analyzed.
- The review does not assess the safety or reliability of the module's intended persistence mechanism.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.