mirror of
https://github.com/maxDcb/C2Core
synced 2026-06-08 15:48:01 +00:00
maxdcb
77 lines
2.2 KiB
JSON
77 lines
2.2 KiB
JSON
{
|
|
"name": "taskScheduler",
|
|
"display_name": "taskScheduler",
|
|
"kind": "module",
|
|
"description": "Create and optionally run a scheduled task on a local or remote Windows host.",
|
|
"command_template": "taskScheduler [--vault {vault:q}] -c {c:q} [-s {s:q}] [-t {t:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}] [--no-run {no_run:flag}] [--nocleanup {nocleanup:flag}]",
|
|
"target": "beacon",
|
|
"requires_session": true,
|
|
"platforms": ["windows"],
|
|
"archs": ["x86", "x64", "arm64"],
|
|
"args": [
|
|
{
|
|
"name": "--vault",
|
|
"type": "credential",
|
|
"required": false,
|
|
"description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.",
|
|
"credential_filter": {
|
|
"type": "password"
|
|
}
|
|
},
|
|
{
|
|
"name": "-c",
|
|
"type": "flag",
|
|
"required": true,
|
|
"description": "Executable or command to run in the scheduled task."
|
|
},
|
|
{
|
|
"name": "-s",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Target host. Omit for localhost."
|
|
},
|
|
{
|
|
"name": "-t",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Scheduled task name. A random name is used if omitted."
|
|
},
|
|
{
|
|
"name": "-a",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Command line arguments."
|
|
},
|
|
{
|
|
"name": "-u",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "DOMAIN\\user for explicit task registration credentials."
|
|
},
|
|
{
|
|
"name": "-p",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Password for the provided user."
|
|
},
|
|
{
|
|
"name": "--no-run",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Register the task without running it."
|
|
},
|
|
{
|
|
"name": "--nocleanup",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Keep the task after it starts."
|
|
}
|
|
],
|
|
"examples": [
|
|
"taskScheduler --vault cred:credentialId -s HOST -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"",
|
|
"taskScheduler -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"",
|
|
"taskScheduler -s HOST -t UpdateTask -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\" --nocleanup"
|
|
],
|
|
"source": "manifest"
|
|
}
|