Notepad++ Plugin Persistence

MetasploitMetasploit exploitExploitRubyexploit_windows/persistence/notepadpp_plugin

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that establishes persistence on a Windows host by writing a malicious DLL plugin into Notepad++'s plugin directory. The module generates a payload DLL, creates a subdirectory under the plugins folder, and writes the DLL there. Notepad++ automatically loads DLLs from its plugin directory on startup, executing the payload each time the application is launched.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit persistence exploit that installs a user-specified payload DLL into the Notepad++ plugins directory. All behavior aligns with the documented purpose; no concealed backdoor, deceptive payload, or unrelated harmful action is present in the reviewed source code.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesruby
Target softwareNotepad++
Attack typespersistencedll-side-loading
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's primary purpose is to deploy a malicious DLL to achieve code execution and persistence. It includes a check method to verify the target environment but its main function (install_persistence) generates and writes a payload DLL to a location where it will be automatically loaded and executed by Notepad++. This constitutes an exploit as it actively exercises the vulnerability (DLL side-loading) to execute attacker-controlled code.

modules/exploits/windows/persistence/notepadpp_plugin.rb:76-94modules/exploits/windows/persistence/notepadpp_plugin.rb:20

Requirements

  • Requires an existing Meterpreter or shell session on the target Windows system.modules/exploits/windows/persistence/notepadpp_plugin.rb:26
  • Notepad++ must be installed and its plugins directory must be writable.modules/exploits/windows/persistence/notepadpp_plugin.rb:57modules/exploits/windows/persistence/notepadpp_plugin.rb:62

Observed behavior

  • Checks for the existence and writability of the Notepad++ plugins directory.modules/exploits/windows/persistence/notepadpp_plugin.rb:55-73
  • Generates a payload DLL using Metasploit's payload generation framework.modules/exploits/windows/persistence/notepadpp_plugin.rb:81
  • Creates a subdirectory under the Notepad++ plugins directory and writes the malicious DLL into it.modules/exploits/windows/persistence/notepadpp_plugin.rb:79-90
  • The DLL is executed when Notepad++ is next launched, providing persistent access.modules/exploits/windows/persistence/notepadpp_plugin.rb:20
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Persistence Mechanism
DLL planting in Notepad++ plugin directoryThe module installs a payload DLL into the Notepad++ plugins directory, which is loaded automatically on application startup. This is the documented purpose of the module.modules/exploits/windows/persistence/notepadpp_plugin.rb:19-20modules/exploits/windows/persistence/notepadpp_plugin.rb:52modules/exploits/windows/persistence/notepadpp_plugin.rb:76-93
Payload Generation
generate_payload_dllThe module generates a DLL payload using the Metasploit framework's standard payload generation method. This is expected behavior for a persistence module.modules/exploits/windows/persistence/notepadpp_plugin.rb:81
Cleanup Mechanism
Resource script cleanup entryThe module appends a command to remove the installed plugin directory to a cleanup resource script, indicating intended removal capability.modules/exploits/windows/persistence/notepadpp_plugin.rb:93
Review boundaries

What the analysis did not establish

  • Only the module source code is provided; Metasploit framework mixins and payload generation logic are not included, so the exact payload and exploitation mechanics cannot be fully traced.
  • The artifact is a single file; no supporting files, build context, or runtime environment are provided.
  • The generated payload DLL is not included in the evidence; its behavior depends on the user-selected Metasploit payload and is outside the scope of this module review.
  • Framework mixins and libraries (e.g., Msf::Post::File, Msf::Exploit::EXE) are not expanded; their standard implementations are assumed but not verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.