Scheduled Tasks
Windows uses the "Task Scheduler" to execute automated tasks. These tasks include clean-up activities and update management software. They are called Scheduled Tasks.
Last updated
Windows uses the "Task Scheduler" to execute automated tasks. These tasks include clean-up activities and update management software. They are called Scheduled Tasks.
Last updated
Scheduled Tasks, or Tasks, are defined by a trigger. A trigger can be set on a time or date, on startup, on log in, or any other condition.
As which user does this task get executed?
What triggers are specified for the task?
What actions are executed when one or more of these triggers are met?
These questions are vital to see if a task can lead to privilege escalation.
We can view scheduled tasks on Windows with the Cmdlet or the command schtasks /query.
NOTE: There are a lot of Scheduled Tasks that run on Windows. This will take time to enumerate but can reveal important information about the host machine.
Like we did with Service hijacking. We find the full path of the scheduled task binary file and replace it with our own. We have to enumerate permissions!.
Once we've enumerated the installed service and found one of interest, we can view the permissions. We can use tools like: icacls Windows utility or the PowerShell Cmdlet Get-ACL
F
Full access
M
Modify access
RX
Read and execute access
R
Read-only access
W
Write-only access
We can create as