#schtasks

[ultra-movaxbx-ru-posts]

Running Code From A Non-Elevated Account At Any Time

Running Code From A Non-Elevated Account At Any Time

Original text

You may have found yourself in a situation where you have access to a system through a limited user account, or could not or did not want to bypass UAC (AlwaysOn setting for example) and you needed to continue running code even when the account logged off and/or the system rebooted (and even if you don’t have the account’s password). For example, as a pentester you may need to…

View On WordPress

[angry-salad-blog]

Back it up

Quick backup script with Windows’ built-in tools

The point here is to make a copy of your data (the important stuff), then move that copy off of your computer. There are programs out there that polish up this process and make it easy, but some are pricey. I like “Syncovery”, personally because it offers a dizzying array of options, most of which are never used. Windows and macOS both come with utilities that when scripted properly, will make for a nice and simple backup regimen. 

On the Windows side, there’s xcopy and robocopy. They both do the same thing (copy files), with robocopy being more versatile for copying to a network location, or between network locations. If you have Windows 7 or later, both are already installed on your system. 

Enter the following into a text editor (notepad.exe, notepad++.exe).

xcopy c:\users\lebowski\documents\* F:\backup\documents\%date:~0,3%\* /Y /Q /S

The above command will copy the Dude’s documents to F\backup\documents\<Mon|Tue|Wed|Thu|Fri|Sat|Sun>. Hopefully, F is an external USB drive of some sort or a mapped drive on a server.

/Y = “Are you sure you want to overwrite an existing file?” Yes

/Q = Copies quietly, without echoing progress in the terminal

/S = Copies all directories and sub directories, unless they are empty.

This might give a few redundant copies of your data, one for each day of the week. If target storage cannot handle that, or you’re just into data-deduplication, then replace “%date:~0,3%” with a static folder, or omit that level entirely.

Robocopy is a bit more involved, but it is worth taking the extra time to get familiar. 

robocopy c:\users\lebowski\documents f:\backup\Documents /NDL /NFL /ZB /COPYALL /NP /r:1 /w:1 /LOG+:C:\RobocopyDocsToBackup.log

Lebowski’s docs are going to the same place, just in style this time.

/NDL = Does not log the names of the directories it copies. 

/NFL = File names are not logged either...

/ZB = Copies files in restart mode, if that doesn’t work, it uses backup mode instead.

/COPYALL = Self-explanatory

/NP = “No problem”, not actually it means that the progress of the operation will not be displayed as in “No progress.”

/r:1 = 1 is the number of times a failed copy will be reattempted.

/w:1 = One second will elapse between the failed re-copy attempt(s). 

/LOG = A log file is written to the root of C: in this case (probably not the best place to drop a log file).

Once you are satisfied that the commands are doing what they are supposed to be doing, save two copies of the file with either a BAT or CMD file extension, “backup.cmd” for example. Place one copy with your other work (for safe keeping), and the other outside of your user profile (to run in a scheduled task). 

Open an administrative command prompt and enter the following.

SchTasks /Create /SC DAILY /TN “Daily_Backup” /TR “C:\Windows\System32\backup.cmd” /ST 00:00 

/CREATE = ...

/SC DAILY = Schedule? Daily from <MINUTE, HOURLY, DAILY, WEEKLY, MONTHLY, ONCE, ONSTART, ONLOGON, ONIDLE>

/TN = Task Name “Daily_Backup” (The command wouldn’t run for me with a space in the name)

/TR = “Task to run”, in this case our backup.cmd

/ST = “Scheduled time”, zero hour, midnight

The task will run under the user account which created the task, so make sure that account had read access to the source directories and write access to the destination.

Cheers and thanks to the following online resources!

Microsoft Schtasks page

Microsoft Technet “Robocopy and a few examples” page

This dude’s page

[suisui-tech]

/RU /RP

[suisui-tech]

PowerShell を使ってローカルからリモートのタスク スケジュールを操作する方法は、リモートの環境によって異なります。Windows 8/Windows Server 2012 であればStart-ScheduledTask コマンドレットを実行できます。

[suisui-tech]

net use delete

[t9-grv]

Windows Scheduler

SCHTASKS/parameter [arguments]

Description:

Enables an administrator to create, delete, query, change, run and end scheduled tasks on a local or remote system. Replaces AT.exe.

Parameter List:

/CreateCreates a new scheduled task./DeleteDeletes the scheduled task(s)./QueryDisplays all scheduled tasks./ChangeChanges the properties of scheduled task./RunRuns the scheduled task immediately./EndStops the currently running scheduled task./?Displays this help/usage.

Examples:

SCHTASKS SCHTASKS/?SCHTASKS/Run /?SCHTASKS/End /?SCHTASKS/Create /?SCHTASKS/Delete /?SCHTASKS/Query /?SCHTASKS/Change /?

/RUN

SCHTASKS/Run [/S system [/U username [/P password]]] /TN taskname

Description:

Runs a scheduled task immediately.

Parameter List:

/S systemSpecifies the remote system to connect to./U usernameSpecifies the user context under which the command should execute./P passwordSpecifies the password for the given user context./TN tasknameIdentifies the scheduled task to run./?Displays this help/usage.

Examples:

SCHTASKS/Run /?SCHTASKS/Run /TN "Start Backup"SCHTASKS/Run /S system /U user /P password /TN "Backup and Restore"

/END

SCHTASKS/End [/S system [/U username [/P password]]] /TN tasknameSCHTASKS/End [/S system [/U username [/P password]]] /TN taskname

Description:

Stops a running scheduled task.

Parameter List:

/S systemSpecifies the remote system to connect to./U usernameSpecifies the user context under which the command should execute./P passwordSpecifies the password for the given user context./TN tasknameSpecifies the scheduled task to terminate./?Displays this help/usage.

Examples:

SCHTASKS/End /?SCHTASKS/End /TN "Start Backup"SCHTASKS/End /S system /U user /P password /TN "Backup and Restore"

/CREATE

SCHTASKS/Create [/S system [/U username [/P password]]] [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day] [/I idletime] /TN taskname /TR taskrun [/ST starttime] [/M months] [/SD startdate] [/ED enddate]

Description:

Enables an administrator to create scheduled tasks on a local or remote systems.

Parameter List:

/S systemSpecifies the remote system to connect to. If omitted the system parameter defaults to the local system./U usernameSpecifies the user context under which the command should execute./P passwordSpecifies the password for the given user context./RU usernameSpecifies the user account (user context) under which the task runs. For the system account, valid values are "", "NT AUTHORITY\SYSTEM" or "SYSTEM"./RP passwordSpecifies the password for the user. To prompt for the password, the value must be either "*" or none. Password will not effect for the system account./SC scheduleSpecifies the schedule frequency. Valid schedule types: MINUTE, HOURLY, DAILY, WEEKLY, MONTHLY, ONCE, ONSTART, ONLOGON, ONIDLE./MO modifierRefines the schedule type to allow finer control over schedule recurrence. Valid values are:MINUTE:1 - 1439 minutes.HOURLY:1 - 23 hours.DAILY:1 - 365 days.WEEKLY:weeks 1 - 52.ONCE:No modifiers.ONSTART:No modifiers.ONLOGON:No modifiers.ONIDLE:No modifiers.MONTHLY:1 - 12, or FIRST, SECOND, THIRD, FOURTH, LAST, LASTDAY./D daysSpecifies the day of the week to run the task. Valid values: MON, TUE, WED, THU, FRI, SAT, SUN and for MONTHLY schedules 1 - 31 (days of the month)./M monthsSpecifies month(s) of the year. Defaults to the first day of the month. Valid values: JAN, FEB, MAR, APR, MAY, JUN, JUL, AUG, SEP, OCT, NOV, DEC./I idletimeSpecifies the amount of idle time to wait before running a scheduled ONIDLE task. Valid range: 1 - 999 minutes./TN tasknameSpecifies a name which uniquely identifies this scheduled task./TR taskrunSpecifies the path and file name of the program to be run by this scheduled task. Example: C:\windows\system32\calc.exe/ST starttimeSpecifies the time to run the task. The time format is HH:MM:SS (24 hour time) for example, 14:30:00 for 2:30 PM./SD startdateSpecifies the first date on which the task runs. The format is "dd/mm/yyyy"./ED enddateSpecifies the last date when the task should run. The format is "dd/mm/yyyy"./?Displays this help/usage.

Examples:

SCHTASKS/Create /S system /U user /P password /RU runasuser /RP runaspassword /SC HOURLY /TN rtest1 /TR notepadSCHTASKS/Create /S system /U user /P password /RU runasuser /RP runaspassword /SC HOURLY /TN rtest1 /TR notepadSCHTASKS/Create /S system /U domain\user /P password /SC MINUTE /MO 5 /TN rtest2 /TR calc.exe /ST 12:00:00 /SD 15/09/2001 /ED 15/09/2001 /RU runasuser /RP *SCHTASKS/Create /SC MONTHLY /MO first /D SUN /TN game /TR c:\windows\system32\freecellSCHTASKS/Create /S system /U user /P password /RU runasuser /RP runaspassword /SC WEEKLY /TN test1 /TR notepad.exeSCHTASKS/Create /S system /U domain\user /P password /SC MINUTE /MO 5 /TN test2 /TR c:\windows\system32\notepad.exe /ST 18:30:00 /RU runasuser /RP *SCHTASKS/Create /SC MONTHLY /MO first /D SUN /TN cell /TR c:\windows\system32\freecell /RU runasuser

/DELETE

SCHTASKS/Delete [/S system [/U username [/P password]]] /TN taskname [/F]

Description:

Deletes one or more scheduled tasks.

Parameter List:

/S systemSpecifies the remote system to connect to./U usernameSpecifies the user context under which the command should execute./P passwordSpecifies the password for the given user context./TN tasknameSpecifies the name of the scheduled task to delete. Wildcard "*" may be used to delete all tasks./F(Force) Deletes the task and suppresses warnings if the specified task is currently running./?Displays this help/usage.

Examples:

SCHTASKS/Delete /TN * /FSCHTASKS/Delete /TN "Backup and Restore"SCHTASKS/Delete /S system /U user /P password /TN "Start Restore"SCHTASKS/Delete /S system /U user /P password /TN "Start Backup" /F

/QUERY

SCHTASKS/Query [/S system [/U username [/P password]]] [/FO format] [/NH] [/V] [/?]

Description:

Enables an administrator to display the scheduled tasks on the local or remote system.

Parameter List:

/S systemSpecifies the remote system to connect to./U usernameSpecifies the user context under which the command should execute./P passwordSpecifies the password for the given user context./FO formatSpecifies the output format to be displayed. Valid values: TABLE, LIST, CSV./NHSpecifies that the column header should not be displayed in the output. Valid only for TABLE and CSV formats./VSpecifies additional output to be displayed./?Displays this help/usage.

Examples:

SCHTASKS/QuerySCHTASKS/Query /?SCHTASKS/Query /S system /U user /P passwordSCHTASKS/Query /FO LIST /V /S system /U user /P passwordSCHTASKS/Query /FO TABLE /NH /V

/CHANGE

SCHTASKS/Change [/S system [/U username [/P password]]] {[/RU runasuser] [/RP runaspassword] [/TR taskrun]} /TN taskname

Description:

Changes the program to run, or user account and password used by a scheduled task.

Parameter List:

/S systemSpecifies the remote system to connect to./U usernameSpecifies the user context under which the command should execute./P passwordSpecifies the password for the given user context./RU usernameChanges the user name (user context) under which the scheduled task has to run. For the system account, valid values are "", "NT AUTHORITY\SYSTEM" or "SYSTEM"./RP passwordSpecifies a new password for the existing user context or the password for a new user account. Password will not effect for the system account./TR taskrunSpecifies a new program that the scheduled task runs. Type the path and file name of the program./TN tasknameSpecifies which scheduled task to change./?Displays this help/usage.

Examples:

SCHTASKS/Change /RP password /TN "Backup and Restore"SCHTASKS/Change /TR restore.exe /TN "Start Restore"SCHTASKS/Change /S system /U user /P password /RU newuser /TN "Start Backup"