Skip to content

Address review feedback on Windows Port Monitor persistence module - #13

Open
prithvee07 wants to merge 1 commit into
Nayeraneru:win-port-monitorfrom
prithvee07:port-monitor-fixes
Open

Address review feedback on Windows Port Monitor persistence module#13
prithvee07 wants to merge 1 commit into
Nayeraneru:win-port-monitorfrom
prithvee07:port-monitor-fixes

Conversation

@prithvee07

Copy link
Copy Markdown

Applies the requested changes from dledda-r7 and h00die's review on rapid7#21128 (Nayeraneru's win-port-monitor branch):

  • Removed the DefaultOptions block disabling the payload handler and hardcoding a meterpreter/reverse_tcp payload; persistence modules need the handler active to catch the callback when the payload fires later.
  • Dropped ARCH_AARCH64 from Arch, since Metasploit has no meterpreter or shell payload for that architecture yet.
  • Restricted SessionTypes to meterpreter only.
  • DLL_NAME no longer fails validation when missing a .dll extension; payload_name now appends it automatically.
  • MONITOR_NAME and DLL_NAME now default to randomized 8-character alpha strings instead of static "Hadess"/"persist.dll" values, and are marked required to match.
  • Documentation: restructured Scenarios headings (### OS / #### scenario per h00die's convention), removed the unrelated local_exploit_suggester detour, fixed an escaped entity and a doubled backslash in a code span, and updated the Options section for the new randomized defaults. Passes tools/dev/msftidy_docs.rb clean.

Claude-Session: https://claude.ai/code/session_01Ae2LTwjw9tvJqqGqqwjerz

Thank you for contributing to Metasploit Framework! Your time and effort help make this project better for the entire security community. If you have questions at any point, reach out on GitHub Discussions or the Metasploit Slack.

Description

Related Issue:

Breaking Changes

None

Reviewer Notes

Verification Steps

    • [ ]

Test Evidence

Environment

Field Details
Operating System
Target Software/Hardware
Docker Image / Vagrant Setup

AI Usage Disclosure

Pre-Submission Checklist

  • Included a corresponding documentation markdown file in documentation/modules (new modules only)
  • No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
  • Tested on the target environment specified in the Environment section above
  • Included RSpec tests for library changes (encouraged for lib/ changes)
  • Read the CONTRIBUTING.md and module acceptance guidelines
Hardware and Complex Software Module Guidance

If your module targets specialized hardware (routers, IoT, PLCs, etc.) or complex software (licensed, multi-service, or multi-version), provide a pcap, screen recording, or video showing successful execution.

Email sanitized pcaps/recordings to msfdev@metasploit.com — remove real IPs, credentials, and hostnames before sending. If hardware/software is unavailable, explain in the PR description.

Responsiveness and PR Takeover Policy

We want every contribution to make it into the project. If approximately 2 weeks pass after a review request without a comment or code update from you, the team may take over the PR and complete the work on your behalf.

If this happens, you will remain credited as a co-author on the final commit — your contribution is always recognized.

This policy exists to keep the project moving forward. It is not a reflection on the quality of your work or your involvement. Life happens, and we would rather finish the work together than let a good contribution go stale.

Applies the requested changes from dledda-r7 and h00die's review on
rapid7#21128 (Nayeraneru's win-port-monitor branch):

- Removed the DefaultOptions block disabling the payload handler and
  hardcoding a meterpreter/reverse_tcp payload; persistence modules need
  the handler active to catch the callback when the payload fires later.
- Dropped ARCH_AARCH64 from Arch, since Metasploit has no meterpreter or
  shell payload for that architecture yet.
- Restricted SessionTypes to meterpreter only.
- DLL_NAME no longer fails validation when missing a .dll extension;
  payload_name now appends it automatically.
- MONITOR_NAME and DLL_NAME now default to randomized 8-character alpha
  strings instead of static "Hadess"/"persist.dll" values, and are marked
  required to match.
- Documentation: restructured Scenarios headings (### OS / #### scenario
  per h00die's convention), removed the unrelated local_exploit_suggester
  detour, fixed an escaped   entity and a doubled backslash in a code
  span, and updated the Options section for the new randomized defaults.
  Passes tools/dev/msftidy_docs.rb clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ae2LTwjw9tvJqqGqqwjerz
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants