Rapid7

module

Joplin Plugin Persistence

Try Surface Command
Back to search
Disclosed
Dec 7, 2017
Created
Jun 19, 2026

Description

This module installs a malicious Joplin plugin (.jpl) into the target's
Joplin plugin directory. The plugin executes the payload each time Joplin
is launched, providing persistent code execution. Joplin can not
be running at the time of plugin installation, or it will be overwriten
at shutdown. The module can optionally kill Joplin if it is detected running.

Tested against Joplin 3.6.11 on Windows 10, 3.6.10 on Kali

Author

h00die

Platform

Linux,Unix,Windows

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/persistence/joplin_plugin
    msf exploit(joplin_plugin) > show targets
        ...targets...
    msf exploit(joplin_plugin) > set TARGET < target-id >
    msf exploit(joplin_plugin) > show options
        ...show and set options...
    msf exploit(joplin_plugin) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report