Windows Userinit persistence

[6a6f656c]

fixes #20820

Introduces a new persistence module that abuses the Windows UserInit registry mechanism, ensuring a shell is executed each time a user logs in.

Verification

List the steps needed to make sure this thing works

1. get an admin session on windows
2. use exploit/windows/persistence/registry_userinit
3. set session #
4. exploit
5. logoff and log back in, you should get a shell

[h00die]

I had a few minutes, so did the docs for you: 6a6f656c#1

[6a6f656c]

Reviewed

[adfoster-r7]

Maybe some of the comments from $x are relevant here? 🤔

#20843 (comment)

cc @h00die

[dledda-r7]

@h00die was this addressed?

[dledda-r7]

@h00die was this addressed?

[dledda-r7]

Managed to have the connection back, @6a6f656c or @h00die, does this module require Administrator privilage to install the persistence?

[h00die]

@dledda-r7 The return session.sys.config.getenv(d) if d.start_with?('%') stuff hasn't been addressed yet. Because its in a bunch of modules I'm hoping to address it once across all the landed modules instead of doing the modules and then 4 or 5 PRs separately.

[h00die]

Managed to have the connection back, @6a6f656c or @h00die, does this module require Administrator privilage to install the persistence?

I thought writing to the registry did require admin privileges, but I can't remember at this point.

Suggestion committed

[dledda-r7]

Release Notes

This add a persistence module for Windows. Using the UserInit registry key the target machine will create a session with Admin privileges every time any user logs in.