bwatters-r7
Source-scoped identity with 28 associated PoCs and 25 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
MetasploitWindows Silent Process Exit Persistence
Metasploit exploitby Mithun ShanbhagAdded to Metasploit 2025-09-23ExploitUnlinked1 file
Analysis
Technical assessment
This Metasploit module establishes persistence on a Windows system by uploading a payload and configuring the Silent Process Exit mechanism. It sets registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options and SilentProcessExit to trigger the uploaded payload when a specified process exits.
Backdoor review
No backdoor observed in reviewed code
The module implements a documented Windows persistence technique (Silent Process Exit) by uploading a Metasploit-generated payload and setting registry keys to execute it when a specified process exits. No concealed, deceptive, or operator-directed harmful behavior beyond the stated persistence mechanism was observed in the reviewed source code.
ClassificationExploit
Model confidence95%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The module uploads a generated payload and modifies system registry keys to execute it when a target process exits, which constitutes exploitation for persistence. It is classified as an exploit because it actively deploys and triggers malicious code on the target system.
modules/exploits/windows/persistence/image_exec_options.rb:78-82modules/exploits/windows/persistence/image_exec_options.rb:97-121Requirements
- Requires SYSTEM-level privileges on the target Windows host.
modules/exploits/windows/persistence/image_exec_options.rb:73 - Requires an existing Meterpreter or shell session on the target.
modules/exploits/windows/persistence/image_exec_options.rb:34 - Requires a writable directory on the target to store the payload.
modules/exploits/windows/persistence/image_exec_options.rb:71
Observed behavior
- Generates a payload executable and uploads it to a writable directory on the target.
modules/exploits/windows/persistence/image_exec_options.rb:78-82 - Creates and sets registry values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<image_file> and SilentProcessExit\<image_file> to configure the payload as a debugger/monitor process for the specified image file.
modules/exploits/windows/persistence/image_exec_options.rb:97-121 - Records cleanup commands to delete the uploaded payload and registry keys.
modules/exploits/windows/persistence/image_exec_options.rb:132-135
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Payload withheldThis is the documented purpose of the module and matches the description provided in the metadata.
modules/exploits/windows/persistence/image_exec_options.rb:97-121 - Payload Upload
- Payload withheldThis is standard behavior for a Metasploit persistence module and is necessary for the stated functionality.
modules/exploits/windows/persistence/image_exec_options.rb:78-82 - Cleanup Commands
- Payload withheldProvides a mechanism for removing the persistence, which is consistent with a legitimate administrative tool and not indicative of a backdoor.
modules/exploits/windows/persistence/image_exec_options.rb:132-135
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The evidence does not include runtime behavior, target interaction, or verification of successful exploitation.
- The review is limited to the module source code. The behavior of the generated payload (generate_payload_exe) and the Metasploit framework mixins (e.g., Msf::Post::Windows::Registry) is not included in the evidence and was not analyzed.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.