In this demonstration,
we will look at how we can obtain a persistent agent by using a scheduled task.
As we revisit our diagram, in this demonstration,
we're going to focus on the administrator's machine.
What I've done is I've already established an elevated
agent on the IT administrator's machine.
Using that agent,
we will create an additional persistence method using a scheduled task.
Another way that you can establish persistence is
with the use of a scheduled task.
Let's take a look at how this can be done using Empire.
I'm going to interact with my administrative elevated agent,
and I'll confirm the details of the target machine using
the sysinfo command, and we can see that we are currently
logged in as the admin user.
Let's set up a scheduled task by using the module under
persistence, elevated, scheduled tasks.
Let's take a look at the options that's available.
There are a number of options that's available for us to use.
We can define the agent name, Listener. We can go and obfuscate
the commands, bypass the antimalware scripting interface, and we
can define things like the daily time,
and this will be the trigger time for the script. And we can also set
up an idle time in which the script will trigger.
We can define the OnLogan option, and this is a good option to keep enabled.
Ultimately,
what it means is when the machine is rebooted and the user
logs in, the schedule task is kicked off.
We can define the task name and registry path, and with these two options,
it would be a good practice to define values that are not obvious to
the persistence task. In the interest of the demo, I'm going to
change the task name to something obvious,
and I'm going to leave the values for the daily time and the registry path
as it is. Of course, you can tweak this as you please.
I'm going to go ahead now and execute this module,
and I get the warning about it not being OPSEC safe.
I'm going to accept this, and our Empire goes ahead and
creates the persistence scheduled task.
Let's go ahead now and trigger this task to see what happens. Now I
will go ahead and issue the command to run the scheduled task. And as
soon as it has been successfully executed,
we see an agent pops up. And notice that this new agent has
been established under the system context.
This ultimately gives us an agent to the remote system under the system context,
which is the highest privilege possible.
From here, we can perform various other tasks
without worrying about permissions.