Windows Service for User (S4U) Scheduled Task Persistence - Schedule Trigger

MetasploitMetasploit exploitExploitRubyexploit_windows/persistence/service_for_user/schedule

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Metasploit module that installs persistence on a Windows target by creating a scheduled task configured to run with service-for-user (S4U). It generates and uploads a payload executable, constructs a scheduled task XML definition, writes it to disk, and uses schtasks to create the task, establishing a repeatable session.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit persistence exploit that creates a scheduled task to execute a user-supplied payload. All behavior is consistent with documented functionality: generating a payload, uploading it, creating an XML task definition, and registering the task via schtasks. No concealed, deceptive, or operator-directed harm beyond the stated persistence goal was observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesruby
Target softwareMicrosoft Windows
Attack typespersistencescheduled_task
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's primary purpose is to install a persistent payload on a target system. It generates and uploads an executable, creates a scheduled task to execute it, and is classified as an exploit in the Metasploit framework metadata. The code directly exercises the persistence technique by writing files and executing system commands.

modules/exploits/windows/persistence/service_for_user/schedule.rb:6modules/exploits/windows/persistence/service_for_user/schedule.rb:262-286

Requirements

  • Requires an existing Meterpreter session on the target.modules/exploits/windows/persistence/service_for_user/schedule.rb:40
  • Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).modules/exploits/windows/persistence/service_for_user/schedule.rb:28
  • Target must be Windows Vista/2008 or later.modules/exploits/windows/persistence/service_for_user/schedule.rb:80

Observed behavior

  • Generates a payload executable using the Metasploit framework.modules/exploits/windows/persistence/service_for_user/schedule.rb:263
  • Uploads the generated payload executable to a writable directory on the target.modules/exploits/windows/persistence/service_for_user/schedule.rb:270
  • Constructs an XML definition for a scheduled task, substituting the payload path, user context, and trigger times.modules/exploits/windows/persistence/service_for_user/schedule.rb:273-276
  • Writes the constructed XML task definition to a file on the target.modules/exploits/windows/persistence/service_for_user/schedule.rb:279
  • Creates the scheduled task on the target using the schtasks command with the uploaded XML file.modules/exploits/windows/persistence/service_for_user/schedule.rb:232
  • Registers cleanup commands to delete the scheduled task and the payload executable.modules/exploits/windows/persistence/service_for_user/schedule.rb:237-238
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
generate_payload_exeModule generates an executable payload from the framework, which is the expected behavior for a persistence exploit.modules/exploits/windows/persistence/service_for_user/schedule.rb:263
Scheduled Task Creation
schtasks /create /xmlModule uses the standard Windows schtasks command to create a scheduled task from an XML file, consistent with S4U persistence technique.modules/exploits/windows/persistence/service_for_user/schedule.rb:232
Cleanup Mechanism
@clean_up_rcModule registers cleanup commands to delete the scheduled task and payload file, which is a standard Metasploit resource script feature for post-exploitation cleanup.modules/exploits/windows/persistence/service_for_user/schedule.rb:237-238
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module's actual execution, reliability, or safety on a live target is not verified.
  • Review is limited to the module source file; framework mixins (e.g., Msf::Post::File, Exploit::EXE) and the generated payload are not expanded or inspected.
  • The XML template file (s4u_persistence.xml) referenced at line 128 is not included in the evidence, so its exact content is unverified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.