New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Scheduled Task File Permissions Audit module #126

Open

lampnout wants to merge 1 commit into GhostPack:master from lampnout:master

lampnout commented Feb 16, 2024

This PR is opened to add the module "ScheduledTasksAudit" (implemented in ScheduledTasksAuditCommand.cs) on Seatbelt.

The module is hunting for privilege escalation vectors in scheduled tasks by investigating the permissions of the files each action runs.

In summary, the following logic has been implemented:

enumerate the scheduled tasks
apply certain filters to select and investigate scheduled tasks that run under the context of user accounts other than the user that runs Seatbelt
check the file permissions of each action looking for permissions that would allow an attacker replace (or edit) the binaries the scheduled task runs


          Scheduled Task File Permissions Audit module

873d4c6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment