OJ Reeves
Source-scoped identity with 12 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 12 PoCs on this page
MetasploitAccessibility Features (Sticky Keys) Persistence via Debugger Registry Key
Metasploit exploitby h00dieAdded to Metasploit 2025-12-07ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that establishes persistence by modifying the Image File Execution Options (IFEO) Debugger registry key for Windows accessibility executables (e.g., sethc.exe). When the target binary is triggered (e.g., pressing SHIFT 5 times), the system executes a payload instead, providing a SYSTEM shell at the login screen or UAC prompt.
Backdoor review
No backdoor observed in reviewed code
The module implements a well-known Windows persistence technique (sticky keys / accessibility features debugger) by writing a Metasploit-generated payload to disk and setting the Image File Execution Options Debugger registry value. All behavior is consistent with the documented purpose of establishing persistence for later SYSTEM-level access. No concealed, deceptive, or operator-directed harm beyond the stated exploit functionality was observed.
Classification basis and observed behavior
Classification basis
The module writes a payload to disk and modifies the Windows registry to redirect execution of an accessibility binary to that payload, which is the core behavior of an exploit that establishes persistence and enables privilege escalation. The module type is 'exploit' and it includes code to perform the exploitation steps.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:6modules/exploits/windows/persistence/accessibility_features_debugger.rb:136-145Requirements
- Requires an existing Meterpreter or shell session with administrative privileges on the target Windows system.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:50modules/exploits/windows/persistence/accessibility_features_debugger.rb:131 - A payload binary must be manually uploaded to the target prior to running the module if a custom payload is used.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:41-42
Observed behavior
- Generates a payload executable and writes it to a writable directory on the target.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:139-142 - Creates or modifies the IFEO registry key for the selected accessibility binary (e.g., sethc.exe) and sets the Debugger value to the path of the payload executable.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:143-145 - When the accessibility feature is triggered (e.g., SHIFT 5 times), Windows executes the payload instead of the original binary, providing a SYSTEM shell at the login screen or UAC prompt.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:27-30modules/exploits/windows/persistence/accessibility_features_debugger.rb:147
Behaviors behind the backdoor verdict
Observables
- Registry Modification
- Payload withheldCore persistence mechanism: redirects execution of accessibility binaries to attacker payload.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:18-19modules/exploits/windows/persistence/accessibility_features_debugger.rb:143-145 - File Write
- Payload withheldWrites the Metasploit-generated payload to disk for execution via the debugger hook.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:139-142 - Cleanup Commands
- Payload withheldModule provides cleanup instructions to remove the payload file and registry modification.
modules/exploits/windows/persistence/accessibility_features_debugger.rb:148-149
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the exact payload generation and file write mechanisms are not fully detailed.
- The evidence does not include runtime behavior or confirmation that the module successfully exploits a target.
- The analysis covers only the module source file; Metasploit framework mixins, libraries, and the actual payload generation code are not included in the evidence. The behavior of the generated payload is not reviewed.
- Binary files are not present in the evidence; the review is limited to the provided text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.