Scheduled Task Backdoor

Description

This persistence technique backdoors a scheduled task by adding an additional action to it. In this module, you will provide a scheduled task name to backdoor, and a system command to run.

Privileges Required

• Non-admin privileges (for non-admin scheduled tasks)
• Admin privileges (for admin scheduled tasks)

Arguments/Options Required

• -c - command to execute
• -a - arguments to command to execute (if applicable)
• -n - scheduled task name
• -m - method (add, remove, check, list)
• -o - optional add-on for frequency (logon, daily, hourly) if applicable

Changes Made to Target System/Caveats

Adding Scheduled Task Backdoor Persistence

• Action is added to the scheduled task with your system command provided. Your additional action will run after the first action has completed.
• When backdooring scheduled task as admin, you need to be in high integrity process (safe check for this)

Removing Scheduled Task Backdoor Persistence

• The very last action added to the scheduled task is removed, which is yours that you added.

Usage/Examples

Adding Scheduled Task Backdoor Persistence Trigger

SharPersist -t schtaskbackdoor -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Something Cool" -m add

Removing Scheduled Task Backdoor Persistence Trigger

SharPersist -t schtaskbackdoor -n "Something Cool" -m remove

Perform Dry Run of Scheduled Task Backdoor Persistence Trigger

SharPersist -t schtaskbackdoor -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Something Cool" -m check

List All Scheduled Tasks

SharPersist -t schtaskbackdoor -m list

List All Scheduled Tasks by Name

SharPersist -t schtaskbackdoor -m list -n "Some Task"

List All Scheduled Tasks by Frequency

SharPersist -t schtaskbackdoor -m list -o logon

References

• https://github.com/dahall/taskscheduler