ScheduleRunner – A C# Tool With More Flexibility To Customize Scheduled Task For Both Persistence And Lateral Movement In Red Team Operation

Click the icon to Follow me:- twitterTelegramRedditDiscord

Scheduled task is one of the most popular attack technique in the past decade and now it is still commonly used by hackers/red teamers for persistence and lateral movement.

A number of C# tools were already developed to simulate the attack using scheduled task. I have been playing around with some of them but each of them has its own limitations on customizing the scheduled task. Therefore, this project aims to provide a C# tool to include the features that I want and provide enough flexibility on customizing the scheduled task.

Methods (/method):

Method Function
create create a new scheduled task
delete delete an existing scheduled task
run execute an existing scheduled task
query query details for a scheduled task or all scheduled tasks under a folder
queryfolders query all sub-folders in scheduled task
move perform lateral movement using scheduled task (automatically create, run and delete)

Options for scheduled task creation (/method:create):

Method Function
[*] /taskname Specify the name of the scheduled task
[*] /program Specify the program that the task runs
[*] /trigger Specify the schedule type. The valid values include: “minute”, “hourly”, “daily”, “onstart”, “onlogon”, “onidle”
/modifier Specify how often the task runs within its schedule type. Applicable only for schedule type such as “minute” (e.g., 1-1439 minutes) and “hourly” (e.g., 1-23 hours)
/starttime Specify the start time for daily schedule type (e.g., 23:30)
/argument Specify the command line argument for the program
/folder Specify the folder where the scheduled task stores (default: )
/author Specify the author of the scheduled task
/description Specify the description for the scheduled task
/remoteserver Specify the hostname or IP address of a remote computer
/user Run the task with a specified user account

[*] are mandatory fields.

Options for scheduled task deletion (/method:delete):

Method Function
[*] /taskname Specify the name of the scheduled task
/folder Specify the folder where the scheduled task stores (default: )
/remoteserver Specify the hostname or IP address of a remote computer

[*] are mandatory fields.

Options for scheduled task execution (/method:run):

Method Function
[*] /taskname Specify the name of the scheduled task
/folder Specify the folder where the scheduled task stores (default: )
/remoteserver Specify the hostname or IP address of a remote computer

[*] are mandatory fields.

Options for scheduled task query (/method:query):

Method Function
/taskname Specify the name of the scheduled task
/folder Specify the folder where the scheduled task stores (default: )
/remoteserver Specify the hostname or IP address of a remote computer

[*] are mandatory fields.

Options for scheduled task lateral movement (/method:move):

Method Function
[*] /taskname Specify the name of the scheduled task
[*] /program Specify the program that the task runs
[*] /remoteserver Specify the hostname or IP address of a remote computer
/trigger Specify the schedule type. The valid values include: “minute”, “hourly”, “daily”, “onstart”, “onlogon”, “onidle”
/modifier Specify how often the task runs within its schedule type. Applicable only for schedule type such as “minute” (e.g., 1-1439 minutes) and “hourly” (e.g., 1-23 hours)
/starttime Specify the start time for daily schedule type (e.g., 23:30)
/argument Specify the command line argument for the program
/folder Specify the folder where the scheduled task stores (default: )
/author Specify the author of the scheduled task
/description Specify the description for the scheduled task
/user Run the task with a specified user account

[*] are mandatory fields.

Examples

Create a scheduled task called “Cleanup” that will be executed every day at 11:30 p.m.

ScheduleRunner.exe /method:create /taskname:Cleanup /trigger:daily /starttime:23:30 /program:calc.exe /description:"Some wordings" /author:netero1010

Create a scheduled task called “Cleanup” that will be executed every 4 hours on a remote server

ScheduleRunner.exe /method:create /taskname:Cleanup /trigger:hourly /modifier:4 /program:rundll32.exe /argument:c:temppayload.dll /remoteserver:TARGET-PC01

Delete a scheduled task called “Cleanup”

ScheduleRunner.exe /method:delete /taskname:Cleanup

Execute a scheduled task called “Cleanup”

ScheduleRunner.exe /method:run /taskname:Cleanup

Query details for a scheduled task called “Cleanup” under “MicrosoftWindowsCertificateServicesClient” folder on a remote server

ScheduleRunner.exe /method:query /taskname:Cleanup /folder:MicrosoftWindowsCertificateServicesClient /remoteserver:TARGET-PC01

Query all scheduled tasks under a specific folder “MicrosoftWindowsCertificateServicesClient” on a remote server

ScheduleRunner.exe /method:query /folder:MicrosoftWindowsCertificateServicesClient /remoteserver:TARGET-PC01

Query all sub-folders in scheduled task

ScheduleRunner.exe /method:queryfolders

Perform lateral movement using scheduled task to a remote server using a specific user account

ScheduleRunner.exe /method:move /taskname:Demo /remoteserver:TARGET-PC01 /program:rundll32.exe /argument:c:temppayload.dll /user:netero1010

Library and Reference Used:

Library Link
TaskScheduler https://github.com/dahall/TaskScheduler
Reference Link
SharpPersist https://github.com/mandiant/SharPersist
Download ScheduleRunner

If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.

Discord

Original Source