Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger

MetasploitMetasploit exploitExploitRubyexploit_windows/persistence/service_for_user/lock_unlock

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that establishes persistence on a Windows target by creating a scheduled task configured to run via Service-for-User (S4U). The task executes an uploaded payload when the workstation is locked or unlocked, allowing code execution even when the user is not interactively logged on.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit persistence exploit that creates a scheduled task triggered by workstation lock/unlock. It uploads a user-chosen payload, writes a task XML, and registers the task via schtasks. No concealed backdoor, credential theft, unrelated remote access, or deceptive behavior was observed. The code performs only the documented persistence actions.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesruby
Target softwareMicrosoft Windows
Attack typespersistencescheduled_task
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a Metasploit exploit that actively deploys a payload and creates a scheduled task to execute it, establishing persistent code execution on the target. It does not merely scan or document a vulnerability; it performs the exploitation steps.

modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:6modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:278-305

Requirements

  • Requires an existing Meterpreter session on the target.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:39
  • Target user must have 'Logon as a batch job' privilege (SeBatchLogonRight).modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:28
  • Target must be Windows Vista/2008 or later.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:80

Observed behavior

  • Generates a malicious executable payload.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:280
  • Uploads the payload to a writable directory on the target.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:289
  • Creates a scheduled task XML definition that triggers on session lock or unlock and executes the uploaded payload.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:164-170modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:200-214
  • Registers the scheduled task on the target system using schtasks.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:248
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
generate_payload_exeThe module generates an executable payload using the standard Metasploit framework method, which is expected behavior for a persistence module.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:280
Scheduled Task Creation
schtasks /create /xmlThe module creates a scheduled task on the target using the schtasks command with a crafted XML file, which is the documented persistence mechanism.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:248
Cleanup Commands
schtasks /delete and rm commandsThe module registers cleanup commands to remove the scheduled task and payload file, which is standard for Metasploit persistence modules.modules/exploits/windows/persistence/service_for_user/lock_unlock.rb:253-254
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact's behavior is inferred from static code analysis; the code was not executed.
  • Review is limited to the module source code; framework mixins, libraries, and external payloads are not expanded or analyzed.
  • Binary files are not inspected; only metadata is available.
  • The actual behavior of the generated payload is not reviewed; the module itself does not contain a backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.