Brandon McCann "zeknox" <bmccann@accuvant.com>
Source-scoped identity with 7 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 7 PoCs on this page
MetasploitWindows Service for User (S4U) Scheduled Task Persistence - Event Trigger
Metasploit exploitby Thomas McCarthy "smilingraccoon" <smilingraccoon@gmail.com>, plus 1 additional contributorAdded to Metasploit 2025-12-27ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that establishes persistence on a Windows target by creating a scheduled task triggered by a Windows Event Log event. It uploads a payload executable, generates a task XML definition with an event-based trigger, and uses schtasks to install the task, allowing code execution even when the user is not logged in.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that creates a scheduled task triggered by a Windows event log entry. It uploads a user-supplied payload, generates task XML, and registers the task via schtasks. No concealed backdoor, credential theft, unrelated remote access, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that actively deploys a payload and creates a scheduled task to execute it, establishing persistence. It does not merely scan or detect; it performs the exploitation action.
modules/exploits/windows/persistence/service_for_user/event.rb:6modules/exploits/windows/persistence/service_for_user/event.rb:288-319Requirements
- Requires an existing Meterpreter session on the target.
modules/exploits/windows/persistence/service_for_user/event.rb:42 - Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).
modules/exploits/windows/persistence/service_for_user/event.rb:28 - Target must be Windows Vista/2008 or later.
modules/exploits/windows/persistence/service_for_user/event.rb:89
Observed behavior
- Generates a payload executable and uploads it to a writable directory on the target.
modules/exploits/windows/persistence/service_for_user/event.rb:293-303 - Creates an XML task definition with an event trigger that executes the uploaded payload when a specified Event ID is logged.
modules/exploits/windows/persistence/service_for_user/event.rb:170-181 - Installs the scheduled task using schtasks /create with the generated XML.
modules/exploits/windows/persistence/service_for_user/event.rb:258 - Registers cleanup commands to delete the task and payload file.
modules/exploits/windows/persistence/service_for_user/event.rb:263-264
Behaviors behind the backdoor verdict
Observables
- Payload Execution
- Payload withheldThe module generates and uploads a payload executable, which is standard for Metasploit persistence modules.
modules/exploits/windows/persistence/service_for_user/event.rb:294 - Scheduled Task Creation
- Payload withheldThe module creates a scheduled task using schtasks and an XML file, a common persistence technique.
modules/exploits/windows/persistence/service_for_user/event.rb:258 - Cleanup Commands
- Payload withheldThe module registers cleanup commands to remove the task and payload, which is normal for Metasploit persistence modules.
modules/exploits/windows/persistence/service_for_user/event.rb:263-264
What the analysis did not establish
- Analysis based solely on module source code and metadata; framework mixins, libraries, and external payloads are not included.
- No runtime behavior or target interaction was observed; classification relies on static code intent.
- Only the module source code was reviewed; framework mixins, libraries, and external payloads are not expanded and could contain unrelated behavior.
- Binary files were not inspected (none present in this evidence).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitWindows Service for User (S4U) Scheduled Task Persistence - Logon Trigger
Metasploit exploitby Thomas McCarthy "smilingraccoon" <smilingraccoon@gmail.com>, plus 1 additional contributorAdded to Metasploit 2025-12-27ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that establishes persistence on a Windows target by creating a scheduled task configured to run via Service-for-User (S4U). The task executes an uploaded payload when the workstation is locked or unlocked, allowing code execution even when the user is not interactively logged on.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that creates a scheduled task triggered by workstation lock/unlock. It uploads a user-chosen payload, writes a task XML, and registers the task via schtasks. No concealed backdoor, credential theft, unrelated remote access, or deceptive behavior was observed. The code performs only the documented persistence actions.
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that actively deploys a payload and creates a scheduled task to execute it, establishing persistent code execution on the target. It does not merely scan or document a vulnerability; it performs the exploitation steps.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:6modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:278-305Requirements
- Requires an existing Meterpreter session on the target.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:39 - Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:28 - Target must be Windows Vista/2008 or later.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:80
Observed behavior
- Generates a malicious executable payload.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:280 - Uploads the payload to a writable directory on the target.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:289 - Creates a scheduled task XML definition that triggers on session lock or unlock and executes the uploaded payload.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:164-170modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:200-214 - Registers the scheduled task on the target system using schtasks.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:248
Behaviors behind the backdoor verdict
Observables
- Payload Generation
- Payload withheldThe module generates an executable payload using the standard Metasploit framework method, which is expected behavior for a persistence module.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:280 - Scheduled Task Creation
- Payload withheldThe module creates a scheduled task on the target using the schtasks command with a crafted XML file, which is the documented persistence mechanism.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:248 - Cleanup Commands
- Payload withheldThe module registers cleanup commands to remove the scheduled task and payload file, which is standard for Metasploit persistence modules.
modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:253-254
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The artifact's behavior is inferred from static code analysis; the code was not executed.
- Review is limited to the module source code; framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files are not inspected; only metadata is available.
- The actual behavior of the generated payload is not reviewed; the module itself does not contain a backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitWindows Service for User (S4U) Scheduled Task Persistence - Logon Trigger
Metasploit exploitby Thomas McCarthy "smilingraccoon" <smilingraccoon@gmail.com>, plus 1 additional contributorAdded to Metasploit 2025-12-27ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that establishes persistence on a Windows target by creating a scheduled task triggered by Winlogon event 4101. It uploads a payload executable, generates a task XML with an event-based trigger, and registers the task via schtasks, allowing code execution in the user's security context even when not logged on.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that creates a scheduled task triggered by a Windows logon event. It uploads a generated payload, writes an XML task definition, and registers the task via schtasks. No concealed backdoor, credential theft, unrelated remote access, or deceptive behavior was observed in the reviewed source.
Classification basis and observed behavior
Classification basis
The module's primary purpose is to deploy and execute a payload on a target system to achieve persistence. It uploads an executable, creates a scheduled task, and triggers code execution, which constitutes exploitation behavior. The module type is 'exploit' and it includes an 'install_persistence' method that performs the full exploit chain.
modules/exploits/windows/persistence/service_for_user/logon.rb:6modules/exploits/windows/persistence/service_for_user/logon.rb:274-301Requirements
- Requires an existing Meterpreter session on the target.
modules/exploits/windows/persistence/service_for_user/logon.rb:39 - Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).
modules/exploits/windows/persistence/service_for_user/logon.rb:28 - Target must be Windows Vista/2008 or later.
modules/exploits/windows/persistence/service_for_user/logon.rb:79
Observed behavior
- Generates a payload executable and uploads it to a writable directory on the target.
modules/exploits/windows/persistence/service_for_user/logon.rb:275-285 - Creates a scheduled task XML definition with an event trigger for Winlogon event 4101, substituting the payload path and user context.
modules/exploits/windows/persistence/service_for_user/logon.rb:126-168 - Writes the XML to the target filesystem and registers the scheduled task using schtasks /create.
modules/exploits/windows/persistence/service_for_user/logon.rb:216-271 - Registers cleanup commands to delete the task and payload file when the session ends.
modules/exploits/windows/persistence/service_for_user/logon.rb:249-250
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Payload withheldThe module's stated purpose is to establish persistence by creating a scheduled task that executes a payload on logon events.
modules/exploits/windows/persistence/service_for_user/logon.rb:23-30modules/exploits/windows/persistence/service_for_user/logon.rb:163-164 - Payload Generation
- Payload withheldThe module generates an executable payload using the standard Metasploit payload generation method, which is expected for an exploit module.
modules/exploits/windows/persistence/service_for_user/logon.rb:276 - Cleanup Commands
- Payload withheldThe module appends cleanup commands to @clean_up_rc, which is a standard Metasploit pattern for resource script cleanup, not a backdoor.
modules/exploits/windows/persistence/service_for_user/logon.rb:249-250
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not included.
- The artifact was not executed, and its behavior is inferred from static code analysis.
- Review is limited to the module source file; framework mixins (e.g., Msf::Post::File, Exploit::EXE) and external payloads are not expanded or analyzed.
- The XML template file (s4u_persistence.xml) referenced at line 127 is not included in the evidence and was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitWindows Service for User (S4U) Scheduled Task Persistence - Schedule Trigger
Metasploit exploitby Thomas McCarthy "smilingraccoon" <smilingraccoon@gmail.com>, plus 1 additional contributorAdded to Metasploit 2025-12-27ExploitUnlinked1 file
Analysis
Technical assessment
This is a Metasploit module that installs persistence on a Windows target by creating a scheduled task configured to run with service-for-user (S4U). It generates and uploads a payload executable, constructs a scheduled task XML definition, writes it to disk, and uses schtasks to create the task, establishing a repeatable session.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that creates a scheduled task to execute a user-supplied payload. All behavior is consistent with documented functionality: generating a payload, uploading it, creating an XML task definition, and registering the task via schtasks. No concealed, deceptive, or operator-directed harm beyond the stated persistence goal was observed.
Classification basis and observed behavior
Classification basis
The module's primary purpose is to install a persistent payload on a target system. It generates and uploads an executable, creates a scheduled task to execute it, and is classified as an exploit in the Metasploit framework metadata. The code directly exercises the persistence technique by writing files and executing system commands.
modules/exploits/windows/persistence/service_for_user/schedule.rb:6modules/exploits/windows/persistence/service_for_user/schedule.rb:262-286Requirements
- Requires an existing Meterpreter session on the target.
modules/exploits/windows/persistence/service_for_user/schedule.rb:40 - Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).
modules/exploits/windows/persistence/service_for_user/schedule.rb:28 - Target must be Windows Vista/2008 or later.
modules/exploits/windows/persistence/service_for_user/schedule.rb:80
Observed behavior
- Generates a payload executable using the Metasploit framework.
modules/exploits/windows/persistence/service_for_user/schedule.rb:263 - Uploads the generated payload executable to a writable directory on the target.
modules/exploits/windows/persistence/service_for_user/schedule.rb:270 - Constructs an XML definition for a scheduled task, substituting the payload path, user context, and trigger times.
modules/exploits/windows/persistence/service_for_user/schedule.rb:273-276 - Writes the constructed XML task definition to a file on the target.
modules/exploits/windows/persistence/service_for_user/schedule.rb:279 - Creates the scheduled task on the target using the schtasks command with the uploaded XML file.
modules/exploits/windows/persistence/service_for_user/schedule.rb:232 - Registers cleanup commands to delete the scheduled task and the payload executable.
modules/exploits/windows/persistence/service_for_user/schedule.rb:237-238
Behaviors behind the backdoor verdict
Observables
- Payload Generation
- Payload withheldModule generates an executable payload from the framework, which is the expected behavior for a persistence exploit.
modules/exploits/windows/persistence/service_for_user/schedule.rb:263 - Scheduled Task Creation
- Payload withheldModule uses the standard Windows schtasks command to create a scheduled task from an XML file, consistent with S4U persistence technique.
modules/exploits/windows/persistence/service_for_user/schedule.rb:232 - Cleanup Mechanism
- Payload withheldModule registers cleanup commands to delete the scheduled task and payload file, which is a standard Metasploit resource script feature for post-exploitation cleanup.
modules/exploits/windows/persistence/service_for_user/schedule.rb:237-238
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual execution, reliability, or safety on a live target is not verified.
- Review is limited to the module source file; framework mixins (e.g., Msf::Post::File, Exploit::EXE) and the generated payload are not expanded or inspected.
- The XML template file (s4u_persistence.xml) referenced at line 128 is not included in the evidence, so its exact content is unverified.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.