Create schtask.py

[Dfte]

Add the schtask module that can be used to impersonate loggedon users and run commands on their behalf.
To run a whoami as the WHITEFLAG\Administrateur:

netexec smb 192.168.56.10 -u Administrateur -p pass -M schtask -o CMD="whoami" USER="WHITEFLAG\Administrateur"

This can be used to run remote commands as well:

[zblurx]

In accordance with Defte, I've updated the code to manage the codec.
LGTM now

[Marshall-Hallenbeck]

Please also add this to the tests/e2e_commands.txt in the appropriate section where other SMB modules are tested.

[Shad0wC0ntr0ller]

This looks good, seems to do something similar to ATExec. Some opsec considerations, there is a hardcoded date in the XML used to build the scheduled task

2015-07-15T20:35:13.2757294

we can use a function to generate to get the latest date and build the xml file

something like

from datetime import datetime

def get_current_date():
    # Get current date and time
    now = datetime.now()

    # Format it to match the format in the XML: "YYYY-MM-DDTHH:MM:SS.ssssss"
    return now.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3]

current_date = get_current_date()
xml = f"""<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
    <!-- ... -->
    <StartBoundary>{current_date}</StartBoundary>
    <!-- ... -->
    <Principal id="TrustedInstaller">
        <UserId>S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464</UserId>
        <RunLevel>HighestAvailable</RunLevel>
    </Principal>
    <!-- ... -->
</Task>"""

Lastly, i have not fully went through the module to see how your doing it, but we can also swap out the principal id from LocalSystem to "TrustedInstaller" . you also need to change the sid to "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464". Just another option for more privileges. This is shown in my xml example

[Dfte]

This looks good, seems to do something similar to ATExec. Some opsec considerations, there is a hardcoded date in the XML used to build the scheduled task

2015-07-15T20:35:13.2757294

we can use a function to generate to get the latest date and build the xml file

something like

from datetime import datetime

def get_current_date():
    # Get current date and time
    now = datetime.now()

    # Format it to match the format in the XML: "YYYY-MM-DDTHH:MM:SS.ssssss"
    return now.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3]

current_date = get_current_date()
xml = f"""<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
    <!-- ... -->
    <StartBoundary>{current_date}</StartBoundary>
    <!-- ... -->
    <Principal id="TrustedInstaller">
        <UserId>S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464</UserId>
        <RunLevel>HighestAvailable</RunLevel>
    </Principal>
    <!-- ... -->
</Task>"""

Lastly, i have not fully went through the module to see how your doing it, but we can also swap out the principal id from LocalSystem to "TrustedInstaller" . you also need to change the sid to "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464". Just another option for more privileges. This is shown in my xml example

Yeah we could replace the date! However I'm not sure it is necessarry to replace the TrustedInstaller

[Dfte]

I have added the code to remove the hardcoded date. :)

[XiaoliChan]

I think this can merged into atexec.py, just add a argument in protocol args like "--atexec-user"

nxc 192.168.1.1 -u pwn -p password -x whoami --exec-method atexec --atexec-user {impersonated user}

This module basically is atexec.py

[Dfte]

I think this can merged into atexec.py, just add a argument in protocol args like "--atexec-user"

nxc 192.168.1.1 -u pwn -p password -x whoami --exec-method atexec --atexec-user {impersonated user}

This module basically is atexec.py

Yeah we thought of doing that but it implies adding another argument and refactor a few things. We thought it'd be easier to add a module on its own

[NeffIsBack]

🎉

[NeffIsBack]

It looks to me that there is a different error when the user is not logged on or does not exist. Would that maybe be worth to catch and explain that info to the user?

[NeffIsBack]

Rest looks good to me! Also tested and is working on my side

[Dfte]

It looks to me that there is a different error when the user is not logged on or does not exist. Would that maybe be worth to catch and explain that info to the user?

Definitely, let me do that quickly

[NeffIsBack]

Working on my side now!
@Dfte check if the changes make sense to you

[NeffIsBack]

LGTM

[Dfte]

I have never been able to obtain the "User doesn't exist on the domain" but the PR seems good to me!