Scheduled Task
Sub-technique of T1053 Scheduled Task/Job ↗
Abusing Windows scheduled tasks or admin scripts that run with higher privileges.
How it shows up on Hack The Box
Look for .ps1 or .bat scripts in folders like C:\Scripts or C:\Users\Public that something runs periodically and that you can modify, or whose input files you control.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated 4 min read Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
C2 and post-exploitation › Persistence
Scheduled task
Target
schtasks /create /sc onlogon /tn "Updater" /tr "C:\\Windows\\Temp\\x.exe" /ru SYSTEMNo command matches.