Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger

MetasploitMetasploit exploitExploitRubyexploit_windows/persistence/service_for_user/logon

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that establishes persistence on a Windows target by creating a scheduled task triggered by Winlogon event 4101. It uploads a payload executable, generates a task XML with an event-based trigger, and registers the task via schtasks, allowing code execution in the user's security context even when not logged on.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit persistence exploit that creates a scheduled task triggered by a Windows logon event. It uploads a generated payload, writes an XML task definition, and registers the task via schtasks. No concealed backdoor, credential theft, unrelated remote access, or deceptive behavior was observed in the reviewed source.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagesruby
Target softwareMicrosoft Windows
Attack typespersistencescheduled_task
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's primary purpose is to deploy and execute a payload on a target system to achieve persistence. It uploads an executable, creates a scheduled task, and triggers code execution, which constitutes exploitation behavior. The module type is 'exploit' and it includes an 'install_persistence' method that performs the full exploit chain.

modules/exploits/windows/persistence/service_for_user/logon.rb:6modules/exploits/windows/persistence/service_for_user/logon.rb:274-301

Requirements

  • Requires an existing Meterpreter session on the target.modules/exploits/windows/persistence/service_for_user/logon.rb:39
  • Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).modules/exploits/windows/persistence/service_for_user/logon.rb:28
  • Target must be Windows Vista/2008 or later.modules/exploits/windows/persistence/service_for_user/logon.rb:79

Observed behavior

  • Generates a payload executable and uploads it to a writable directory on the target.modules/exploits/windows/persistence/service_for_user/logon.rb:275-285
  • Creates a scheduled task XML definition with an event trigger for Winlogon event 4101, substituting the payload path and user context.modules/exploits/windows/persistence/service_for_user/logon.rb:126-168
  • Writes the XML to the target filesystem and registers the scheduled task using schtasks /create.modules/exploits/windows/persistence/service_for_user/logon.rb:216-271
  • Registers cleanup commands to delete the task and payload file when the session ends.modules/exploits/windows/persistence/service_for_user/logon.rb:249-250
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Persistence Mechanism
Scheduled task with event trigger (EventID 4101)The module's stated purpose is to establish persistence by creating a scheduled task that executes a payload on logon events.modules/exploits/windows/persistence/service_for_user/logon.rb:23-30modules/exploits/windows/persistence/service_for_user/logon.rb:163-164
Payload Generation
generate_payload_exeThe module generates an executable payload using the standard Metasploit payload generation method, which is expected for an exploit module.modules/exploits/windows/persistence/service_for_user/logon.rb:276
Cleanup Commands
Commands to delete the scheduled task and payload fileThe module appends cleanup commands to @clean_up_rc, which is a standard Metasploit pattern for resource script cleanup, not a backdoor.modules/exploits/windows/persistence/service_for_user/logon.rb:249-250
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not included.
  • The artifact was not executed, and its behavior is inferred from static code analysis.
  • Review is limited to the module source file; framework mixins (e.g., Msf::Post::File, Exploit::EXE) and external payloads are not expanded or analyzed.
  • The XML template file (s4u_persistence.xml) referenced at line 127 is not included in the evidence and was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.