Adds notepad++ persistence module for Windows #20685
Open
+190
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
msutovsky-r7
changed the title
Contributor
|
This was on my list 😂. Lemme know when it's ready to test and I'll handle it |
jvoisin
reviewed
Nov 10, 2025
| fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname + payload_name + '.dll', payload_exe) | ||
|
|
||
| vprint_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_pathname}") | ||
| @clean_up_rc << "rm \"#{payload_pathname.gsub('\\', '/')}\"\n" |
Contributor
There was a problem hiding this comment.
What if payload_pathname contains "?
Contributor
There was a problem hiding this comment.
We have a new API for handling this type of thing, it could be used here https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/base/sessions/windows_escaping.rb#L38
| info, | ||
| 'Name' => 'Notepad++ Plugin Persistence', | ||
| 'Description' => %q{ | ||
| This module create persistence by adding malicious plugin to Notepad++. The application does not perform any checks on plugins its loading. The module drops malicious DLL into plugin directory. Upon starting the Notepad++, malicious DLL gets loaded and executed. This creates persistence mechanism as the DLL will get loaded upon every run of application. |
Contributor
There was a problem hiding this comment.
Suggested change
| This module create persistence by adding malicious plugin to Notepad++. The application does not perform any checks on plugins its loading. The module drops malicious DLL into plugin directory. Upon starting the Notepad++, malicious DLL gets loaded and executed. This creates persistence mechanism as the DLL will get loaded upon every run of application. | |
| This module create persistence by adding a malicious plugin to Notepad++, as it blindly loads and executes DLL from its plugin directory on startup, meaning that the payload will be executed every time Notepad++ is launched. |
msutovsky-r7
changed the title
msutovsky-r7
changed the title
dwelch-r7
reviewed
Nov 13, 2025
| return CheckCode::Safe("Unable to write to #{@plugin_dir}") unless writable?(@plugin_dir) | ||
| rescue RuntimeError | ||
| filename = @plugin_dir + '\\' + Rex::Text.rand_text_alpha((rand(6..13))) | ||
| write_file(@plugin_dir, '') |
Contributor
There was a problem hiding this comment.
Suggested change
| write_file(@plugin_dir, '') | |
| write_file(filename, '') |
Think this may have been a typo
| rescue RuntimeError | ||
| filename = @plugin_dir + '\\' + Rex::Text.rand_text_alpha((rand(6..13))) | ||
| write_file(@plugin_dir, '') | ||
| if exists? @plugin_dir |
Contributor
There was a problem hiding this comment.
Suggested change
| if exists? @plugin_dir | |
| if exists? filename |
similar to the above
|
|
||
| fail_with(Failure::UnexpectedReply, 'Error while creating malicious plugin directory') unless session.fs.dir.mkdir(payload_pathname) | ||
|
|
||
| fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname + payload_name + '.dll', payload_exe) |
Contributor
There was a problem hiding this comment.
Suggested change
| fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname + payload_name + '.dll', payload_exe) | |
| fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname + '.dll', payload_exe) |
I think payload_pathname already includes payload_name
Contributor
Author
There was a problem hiding this comment.
Yeah it does, but the module creates plugin subdirectory called payload_name and it creates payload_name.dll inside that new subdirectory
|
|
||
| vprint_good("Writing payload to #{payload_pathname}") | ||
|
|
||
| fail_with(Failure::UnexpectedReply, 'Error while creating malicious plugin directory') unless session.fs.dir.mkdir(payload_pathname) |
Contributor
There was a problem hiding this comment.
is session.fs compatible with shell sessions?
| fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname + payload_name + '.dll', payload_exe) | ||
|
|
||
| vprint_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_pathname}") | ||
| @clean_up_rc << "rm \"#{payload_pathname.gsub('\\', '/')}\"\n" |
Contributor
There was a problem hiding this comment.
We have a new API for handling this type of thing, it could be used here https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/base/sessions/windows_escaping.rb#L38
Contributor
|
bwatters-r7
reviewed
Nov 18, 2025
| end | ||
|
|
||
| def install_persistence | ||
| @plugin_dir ||= get_plugin_dir |
Contributor
There was a problem hiding this comment.
It would be nice to have a validation check here to make sure that the payload arch matches the notepad++ arch before we go about writing the file to disk.
Contributor
There was a problem hiding this comment.
Something like
I think it would be safe to assume the notepad binary would be the same as the host at this point, but to be sure, you could check the binary.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds new persistence module for Windows - Notepad++ persistence.
Work in progressVulnerable Application
This module create persistence by adding a malicious plugin to Notepad++, as it blindly loads and
executes DLL from its plugin directory on startup,meaning that the payload will be executed every time Notepad++ is launched.
The payload will have same privileges as user executing Notepad++.
Verification Steps
use exploit/windows/persistence/notepad++_persistenceset session #runOptions
PAYLOAD_NAME
Name of the payload file. Defaults to
<random>.dllScenarios
Windows 10
Original shell
Persistence