Python Site-Specific Hook Persistence
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
This Metasploit module installs a persistence mechanism by writing a Python startup hook file (a .pth file) into a site-specific or dist-packages directory. When Python initializes, it automatically executes any 'import' lines in these .pth files, allowing the attacker to run arbitrary commands. The module includes a check for Python and a method to write the malicious hook file containing the encoded payload.
Backdoor review
No backdoor observed in reviewed code
The reviewed module is a standard Metasploit persistence exploit that writes a user-supplied payload to a Python site-specific hook file. The module's behavior is consistent with its documented purpose and does not contain any concealed, deceptive, or operator-directed harmful actions beyond the normal execution of the chosen payload.
Classification basis and observed behavior
Classification basis
The module's primary operation is to install a persistent backdoor by writing a malicious Python startup hook file that executes an attacker-supplied payload. This constitutes an exploit because it actively deploys code to maintain unauthorized access, going beyond mere detection or scanning.
modules/exploits/multi/persistence/python_site_specific_hook.rb:119modules/exploits/multi/persistence/python_site_specific_hook.rb:22Requirements
- Requires an existing session on the target system.
modules/exploits/multi/persistence/python_site_specific_hook.rb:30 - Python must be installed on the target system.
modules/exploits/multi/persistence/python_site_specific_hook.rb:91 - The target Python site-specific or dist-packages directory must be writable by the current user.
modules/exploits/multi/persistence/python_site_specific_hook.rb:107
Observed behavior
- Detects the installed Python version by executing 'python3 --version', 'python2 --version', or 'python --version' on the target.
modules/exploits/multi/persistence/python_site_specific_hook.rb:80-83 - Determines the path to the Python site-packages or dist-packages directory based on the target OS and whether persistence is for the current user or all users.
modules/exploits/multi/persistence/python_site_specific_hook.rb:57-74 - Creates a .pth file in the hooks directory containing an 'import os;os.system("<payload>")' command, which will be executed automatically when Python starts.
modules/exploits/multi/persistence/python_site_specific_hook.rb:119
Behaviors behind the backdoor verdict
Observables
- Payload Execution
- write_file("#{@hooks_path}#{file_name}.pth", %(import os;os.system("#{payload.encoded}") ))The module writes a file containing a Python command that executes the attacker-chosen payload. This is the core persistence mechanism and is explicitly described in the module's metadata.
modules/exploits/multi/persistence/python_site_specific_hook.rb:119 - Persistence Mechanism
- Python site-specific hook directoryThe module targets Python's startup hook mechanism to achieve persistence, as described in the module's description and references.
modules/exploits/multi/persistence/python_site_specific_hook.rb:21-22
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The code was not executed, so its operational reliability or safety is not verified.
- The review is limited to the module source code. The behavior of the framework mixins (e.g., Msf::Post::File, Msf::Exploit::FileDropper) and the final payload.encoded value are not included in the evidence and were not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Linked vulnerabilities
0This PoC is retained in the catalog but is not currently linked to a vulnerability.