Windows Silent Process Exit Persistence

MetasploitMetasploit exploitExploitRubyexploit_windows/persistence/image_exec_options

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit module establishes persistence on a Windows system by uploading a payload and configuring the Silent Process Exit mechanism. It sets registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options and SilentProcessExit to trigger the uploaded payload when a specified process exits.

Backdoor review

No backdoor observed in reviewed code

The module implements a documented Windows persistence technique (Silent Process Exit) by uploading a Metasploit-generated payload and setting registry keys to execute it when a specified process exits. No concealed, deceptive, or operator-directed harmful behavior beyond the stated persistence mechanism was observed in the reviewed source code.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesruby
Target softwareMicrosoft Windows
Attack typespersistenceevent-triggered-execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module uploads a generated payload and modifies system registry keys to execute it when a target process exits, which constitutes exploitation for persistence. It is classified as an exploit because it actively deploys and triggers malicious code on the target system.

modules/exploits/windows/persistence/image_exec_options.rb:78-82modules/exploits/windows/persistence/image_exec_options.rb:97-121

Requirements

  • Requires SYSTEM-level privileges on the target Windows host.modules/exploits/windows/persistence/image_exec_options.rb:73
  • Requires an existing Meterpreter or shell session on the target.modules/exploits/windows/persistence/image_exec_options.rb:34
  • Requires a writable directory on the target to store the payload.modules/exploits/windows/persistence/image_exec_options.rb:71

Observed behavior

  • Generates a payload executable and uploads it to a writable directory on the target.modules/exploits/windows/persistence/image_exec_options.rb:78-82
  • Creates and sets registry values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<image_file> and SilentProcessExit\<image_file> to configure the payload as a debugger/monitor process for the specified image file.modules/exploits/windows/persistence/image_exec_options.rb:97-121
  • Records cleanup commands to delete the uploaded payload and registry keys.modules/exploits/windows/persistence/image_exec_options.rb:132-135
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Persistence Mechanism
Sets GlobalFlag, ReportingMode, and MonitorProcess registry values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options and SilentProcessExit to launch a payload when a specified process exits.This is the documented purpose of the module and matches the description provided in the metadata.modules/exploits/windows/persistence/image_exec_options.rb:97-121
Payload Upload
Generates and writes a Metasploit payload executable to a writable directory on the target.This is standard behavior for a Metasploit persistence module and is necessary for the stated functionality.modules/exploits/windows/persistence/image_exec_options.rb:78-82
Cleanup Commands
Appends commands to @clean_up_rc to delete the uploaded payload and registry keys.Provides a mechanism for removing the persistence, which is consistent with a legitimate administrative tool and not indicative of a backdoor.modules/exploits/windows/persistence/image_exec_options.rb:132-135
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include runtime behavior, target interaction, or verification of successful exploitation.
  • The review is limited to the module source code. The behavior of the generated payload (generate_payload_exe) and the Metasploit framework mixins (e.g., Msf::Post::Windows::Registry) is not included in the evidence and was not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.