Skip to content

Scheduled Task File Permissions Audit module#126

Open
lampnout wants to merge 1 commit into
GhostPack:masterfrom
lampnout:master
Open

Scheduled Task File Permissions Audit module#126
lampnout wants to merge 1 commit into
GhostPack:masterfrom
lampnout:master

Conversation

@lampnout
Copy link
Copy Markdown

This PR is opened to add the module "ScheduledTasksAudit" (implemented in ScheduledTasksAuditCommand.cs) on Seatbelt.

The module is hunting for privilege escalation vectors in scheduled tasks by investigating the permissions of the files each action runs.

In summary, the following logic has been implemented:

  • enumerate the scheduled tasks
  • apply certain filters to select and investigate scheduled tasks that run under the context of user accounts other than the user that runs Seatbelt
  • check the file permissions of each action looking for permissions that would allow an attacker replace (or edit) the binaries the scheduled task runs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant