Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create Process And Choose A User To Run As Via The Task Scheduler (TaskSchedulerRun_SPKL - Speckled)
SECRET//NOFORN
OSB Library: Payload Deployment
Module Name: TaskSchedulerRun_SPKL - Speckled
Module Description: This module uses Microsoft's Task Scheduler 1.0 to create a process or execute a command. The payload, if supplied, is written to a user specified location with user specified attributes. A scheduled task is created, run, and immediately deleted (following verification of process creation). This technique adds a level of indirection in the process creation chain.
PSP/OS Issues: No known PSPPersonal Security Product (Anti-Virus) issues. PSPs should be tested on a case by case basis as this technique may be alerting enough to tip the scale.
('excerpt' missing)
Sharing Level: Unilateral (Probably used in the wild)
Technique Origin: In-house (Probably used in the wild)
Notes:
- Will let you create a process as any user
- To ensure execution as the correct user, provide domain and username
- If no user name is supplied, SYSTEM is used
- If executing as a user who is part of the Administrators group, and the calling process is Administrator+, the process is created with the Administrator token.
Module Specific Structures:
struct PARAM_SPKL
{
WCHAR *wcUser; //The name of the user you wish to execute as - if NULL the current user is used. Include Domain\\Username if required
WCHAR *wcTaskName; //Name of the task being used
WCHAR *wcTargetPath; //The target path of the executable to drop to disk
WCHAR *wcArgs; //Arguments for the payload on disk
DWORD dwAttribs; //The attributes of the target payload on disk
};
Example Code:
HANDLE hHandle = NULL;
IPayload *myPayload = new TaskSchedulerRun_SPKL();
PARAM_SPKL params;
SecureZeroMemory(¶ms, sizeof(PARAM_SPKL));
params.dwAttribs = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM;
params.wcTargetPath = L"C:\\Test Folder\\MyTest.exe";
params.wcArgs = L"1 2 3";
params.wcTaskName = L"TaskName";
IPayload::PayloadErr pErr = myPayload->execute(improvedDummy, sizeof(improvedDummy), ¶ms, sizeof(params), &hHandle);
SECRET//NOFORN