Metasploit Exploit Metadata

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Metasploit module that establishes persistence by modifying the Image File Execution Options (IFEO) Debugger registry key for Windows accessibility executables (e.g., sethc.exe). When the target binary is triggered (e.g., pressing SHIFT 5 times), the system executes a payload instead, providing a SYSTEM shell at the login screen or UAC prompt.

Backdoor review

No backdoor observed in reviewed code

The module implements a well-known Windows persistence technique (sticky keys / accessibility features debugger) by writing a Metasploit-generated payload to disk and setting the Image File Execution Options Debugger registry value. All behavior is consistent with the documented purpose of establishing persistence for later SYSTEM-level access. No concealed, deceptive, or operator-directed harm beyond the stated exploit functionality was observed.

ClassificationExploit

Model confidence95%

AuthenticationRequired

Languagesruby

Target softwareMicrosoft Windows

Attack typespersistenceprivilege escalation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module writes a payload to disk and modifies the Windows registry to redirect execution of an accessibility binary to that payload, which is the core behavior of an exploit that establishes persistence and enables privilege escalation. The module type is 'exploit' and it includes code to perform the exploitation steps.

modules/exploits/windows/persistence/accessibility_features_debugger.rb:6modules/exploits/windows/persistence/accessibility_features_debugger.rb:136-145

Requirements

Requires an existing Meterpreter or shell session with administrative privileges on the target Windows system.modules/exploits/windows/persistence/accessibility_features_debugger.rb:50modules/exploits/windows/persistence/accessibility_features_debugger.rb:131
A payload binary must be manually uploaded to the target prior to running the module if a custom payload is used.modules/exploits/windows/persistence/accessibility_features_debugger.rb:41-42

Observed behavior

Generates a payload executable and writes it to a writable directory on the target.modules/exploits/windows/persistence/accessibility_features_debugger.rb:139-142
Creates or modifies the IFEO registry key for the selected accessibility binary (e.g., sethc.exe) and sets the Debugger value to the path of the payload executable.modules/exploits/windows/persistence/accessibility_features_debugger.rb:143-145
When the accessibility feature is triggered (e.g., SHIFT 5 times), Windows executes the payload instead of the original binary, providing a SYSTEM shell at the login screen or UAC prompt.modules/exploits/windows/persistence/accessibility_features_debugger.rb:27-30modules/exploits/windows/persistence/accessibility_features_debugger.rb:147

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Modification: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>.exe Debugger = <payload_path>Core persistence mechanism: redirects execution of accessibility binaries to attacker payload.modules/exploits/windows/persistence/accessibility_features_debugger.rb:18-19modules/exploits/windows/persistence/accessibility_features_debugger.rb:143-145
File Write: Payload executable written to user-controlled writable directoryWrites the Metasploit-generated payload to disk for execution via the debugger hook.modules/exploits/windows/persistence/accessibility_features_debugger.rb:139-142
Cleanup Commands: rm payload file and reg delete GlobalFlagModule provides cleanup instructions to remove the payload file and registry modification.modules/exploits/windows/persistence/accessibility_features_debugger.rb:148-149

Review boundaries

What the analysis did not establish

Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the exact payload generation and file write mechanisms are not fully detailed.
The evidence does not include runtime behavior or confirmation that the module successfully exploits a target.
The analysis covers only the module source file; Metasploit framework mixins, libraries, and the actual payload generation code are not included in the evidence. The behavior of the generated payload is not reviewed.
Binary files are not present in the evidence; the review is limited to the provided text.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

This PoC is retained in the catalog but is not currently linked to a vulnerability.