Scheduled Tasks
Let’s walk through an example in which we attempt to elevate our privileges
by replacing a binary specified in an action.
For this, we’ll connect once again as steve
to CLIENTWK220 with RDP and start a PowerShell window.
We can view scheduled tasks on Windows with the Get-ScheduledTask Cmdlet
or the command schtasks /query.
We’ll use the latter for this example
to review all scheduled tasks on CLIENTWK220.
We enter /fo with LIST as an argument to specify the output format as list.
Additionally, we’ll add /v to display all properties of a task.
Once the command is executed,
we get a huge amount of output with information
about all scheduled tasks on the system.
We should seek interesting information in the Author,
TaskName, Task To Run, Run As User, and Next Run Time fields.
In our case, “interesting” means that the information partially
or completely answers one of the three questions above.
Let’s review information about the \Microsoft\CacheCleanup task.
Interestingly, the task was created by daveadmin
and the specified action is to execute
BackendCacheCleanup.exe
in the Pictures home directory for steve.
In addition, the times from Last Run Time and Next Run Time
indicate that the task is executed every minute.
The task runs as user daveadmin.
Since the executable file BackendCacheCleanup.exe
is located in a subdirectory of the home directory for steve,
we should have extensive permissions on it.
Let’s check our permissions on this file with icacls.
As expected, we have Full Access (F) permissions,
since the executable file is in the home directory of steve.
Now, we can use our binary adduser.exe again
to replace the executable file specified in the action of the scheduled task.
To do so, we’ll start a Python3 web server to serve our cross-compiled file,
adduser.exe,
and use iwr to download it to CLIENTWK220.
We’ll also copy the original BackendCacheCleanup.exe
so we can restore it after our privilege escalation attack is successful.
Once the scheduled task is executed again,
dave2 should be created and added to the local Administrators group.
After waiting a minute,
we can check if our privilege escalation attack was successful.
We successfully replaced the executable file used by the scheduled task
to create an administrative user whose credentials we control.
Great!
In this section, we leveraged a similar privilege escalation attack
as we did in the “Service Binary Hijacking” section.
This time however,
we focused on scheduled tasks instead of Windows services.
We learned how to effectively enumerate scheduled tasks
and which properties may be of interest to us.
We concluded the section
by replacing the executable file and creating the user dave2,
which is a member of the local Administrators group.