Skip to content

Conversation

@6a6f656c
Copy link
Contributor

@6a6f656c 6a6f656c commented Jan 3, 2026

fixes #20820

Introduces a new persistence module that abuses the Windows UserInit registry mechanism, ensuring a shell is executed each time a user logs in.

Verification

List the steps needed to make sure this thing works

  1. get an admin session on windows
  2. use exploit/windows/persistence/registry_userinit
  3. set session #
  4. exploit
  5. logoff and log back in, you should get a shell

@h00die h00die changed the title Userinit Windows Userinit persistence Jan 3, 2026
@github-actions
Copy link

github-actions bot commented Jan 3, 2026

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

@h00die
Copy link
Contributor

h00die commented Jan 3, 2026

I had a few minutes, so did the docs for you: 6a6f656c#1

Copy link
Contributor Author

@6a6f656c 6a6f656c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed

Add docs and tidy to userinit persistence
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

New Persistence Technique: Windows Registry Logon Script (userinit)

2 participants