Scheduled Tasks

Windows Task Scheduler can execute automated tasks. This tasks can execute binary files and also scripts. Also, The scheduled tasks is running behalf on user that created the task.

Enumeration

The following command list the tasks information in list format:

schtasks /query /fo LIST /v

The results includes:

• The Author

• Next time to run

• The target path of the task (program or script)

Searching non-regular tasks inside a list of full built-in tasks can be frustrating, using Get-ScheduledTasks can be helpful to filter known tasks to find non-regular tasks.

Get-ScheduledTask | ? { $_.Author -notlike "*Microsoft*" -and $_.TaskPath -notlike "*Microsoft\Windows*" }  | Get-ScheduledTaskInfo

Retrieve more information about the non-regular task

schtasks /query /v /fo list /tn "<TaskPath><TaskName>"

Exploit

To exploit this it possible to replace the tasks target file, soon as the task will run again the target file will execute.

First, use icacls to check the permission of the target file. Then replace it with a malicious one and wait for the next time to run.

References

Get-ScheduledTask (ScheduledTasks)MicrosoftLearn

Get-ScheduledTask

schtasks querydocsmsft

schtasks query