Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/jnqpblc/SharpTask
SharpTask is a simple code set to interact with the Task Scheduler service api and is compatible with Cobalt Strike.
https://github.com/jnqpblc/SharpTask
Last synced: 22 days ago
JSON representation
SharpTask is a simple code set to interact with the Task Scheduler service api and is compatible with Cobalt Strike.
- Host: GitHub
- URL: https://github.com/jnqpblc/SharpTask
- Owner: jnqpblc
- Created: 2019-06-30T03:09:32.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2021-02-15T22:58:35.000Z (almost 4 years ago)
- Last Synced: 2024-08-05T17:25:17.850Z (4 months ago)
- Language: C#
- Homepage:
- Size: 3.25 MB
- Stars: 86
- Watchers: 3
- Forks: 21
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - jnqpblc/SharpTask - SharpTask is a simple code set to interact with the Task Scheduler service api and is compatible with Cobalt Strike. (C# #)
README
# SharpTask
SharpTask is a simple code set to interact with the Task Scheduler service API using the same DCERPC process as schtasks.exe, which open with TCP port 135 and is followed by the use of an ephemeral TCP port. This code is compatible with Cobalt Strike.
```
C:>SharpTask.exe
[-] Usage:
--ListAll
--AddTask <24h:time|12:30>
--RemoveTask
--GetRunning
```
### 1. Add a task on a remote system.
```
beacon> execute-assembly SharpTask.exe --AddTask workstn.foo.local 12:30 \ Test "Testing This Thing" C:\Windows\notepad.exe
beacon>
```
### 2. Verify that the task was created.
```
beacon> execute-assembly SharpTask.exe --ListAll workstn.foo.local \
Name: GoogleUpdateTaskMachineCore
Desc: Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.
Action: C:\Program Files\Google\Update\GoogleUpdate.exe /c
Last: 6/29/2019 8:46:33 AM
Result: 0
Next: 6/30/2019 8:46:33 AM
Name: GoogleUpdateTaskMachineUA
Desc: Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.
Action: C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Last: 6/29/2019 9:46:34 PM
Result: 0
Next: 6/29/2019 10:46:33 PM
Name: Test
Desc: Testing This Thing
Action: C:\Windows\notepad.exe
Last: 6/29/2019 10:17:54 PM
Result: 267009
Next: 6/30/2019 12:30:00 PM
```
### 3. Verify that the task is running.
```
beacon> execute-assembly SharpTask.exe --GetRunning workstn.foo.local
Name: SystemSoundsService
Desc: System Sounds User Mode Agent
Action: Microsoft PlaySoundService Class
Name: MsCtfMonitor
Desc: TextServicesFramework monitor task
Action: MsCtfMonitor task handler
Name: CacheTask
Desc: Wininet Cache Task
Action: Wininet Cache task object
Name: Test
Desc: Testing This Thing
Action: C:\Windows\notepad.exe
```
### 4. Stop and remove the task.
```
beacon> execute-assembly SharpTask.exe --RemoveTask workstn.foo.local \ Test
beacon>
```
### 5. Verify that the task was removed.
```
beacon> execute-assembly SharpTask.exe --ListAll workstn.foo.local \
Name: GoogleUpdateTaskMachineCore
Desc: Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.
Action: C:\Program Files\Google\Update\GoogleUpdate.exe /c
Last: 6/29/2019 8:46:33 AM
Result: 0
Next: 6/30/2019 8:46:33 AM
Name: GoogleUpdateTaskMachineUA
Desc: Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.
Action: C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
Last: 6/29/2019 9:46:34 PM
Result: 0
Next: 6/29/2019 10:46:33 PM
```