Description
This module installs a malicious Kate (KTextEditor) plugin that executes the payload each time Kate is launched.
Linux: a pre-built template SO is patched with raw x64 shellcode and uploaded to the target. If the session has write access to the system Qt plugin directory the plugin is installed there directly (no environment changes needed). Otherwise it is installed user-locally with QT_PLUGIN_PATH persisted via KDE Plasma startup scripts, systemd user environment files, and a .desktop file override so the plugin is visible in Kate's plugin manager for both terminal and GUI launches.
Windows: a pre-compiled template DLL is patched with raw x64 shellcode and dropped directly into Kate's own kf6/ktexteditor plugin directory. The directory is located by finding kate.exe then searching for katefilebrowserplugin.dll relative to it. Qt scans Kate's own plugin directory unconditionally at startup - no environment variable or registry changes needed. Kate's install directory is auto-detected.
Tested on 26.04.0 on Kali, 26.07.70 on Windows 10
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/persistence/kate/pluginmsf undefined(plugin) > show actions ...actions...msf undefined(plugin) > set ACTION < action-name >msf undefined(plugin) > show options ...show and set options...msf undefined(plugin) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub