Comments (5)
As far as I can tell, there is only one Principal
per Task
. However, there can be multiple Actions
, and these are not even necessarily Exec
nodes. That's a potential issue, for sure.
According to the XML schema provided by MS here:
<!-- Principals -->
<xs:complexType name="principalsType">
<xs:sequence>
<xs:element name="Principal" type="principalType" maxOccurs="1" />
</xs:sequence>
</xs:complexType>
Although the node is called Principals
, there can be at most one Principal
element inside (maxOccurs="1"
).
<xs:complexType name="actionsType">
<xs:sequence>
<xs:group ref="actionGroup" maxOccurs="32" />
</xs:sequence>
<xs:attribute name="Context" type="xs:IDREF" use="optional" />
</xs:complexType>
There can be up to 32 Actions
per Task
.
<xs:group name="actionGroup">
<xs:choice>
<xs:element name="Exec" type="execType" />
<xs:element name="ComHandler" type="comHandlerType" />
<xs:element name="SendEmail" type="sendEmailType" />
<xs:element name="ShowMessage" type="showMessageType" />
</xs:choice>
</xs:group>
These Actions
can be something other than a simple Exec
node.
So, yeah, I should take this into account... :/
from privesccheck.
Issue fixed, thanks again for your help!
from privesccheck.
The $Principal
variable is also subject to the same issue, which leads to the RunAs
and CurrentUserIsOwner
element not being filled out properly, leading to checks Invoke-ScheduledTasksImagePermissionsCheck
and Invoke-ScheduledTasksUnquotedPathCheck
showing false positives.
I opened PR #9 to fix this issue, feel free to merge or to implement another solution 🙂
from privesccheck.
You made a really good point once again. 🙂
I wonder how many similar bugs are lying in my code now... Perhaps it's time for me to start implementing some unit tests. 🙄
I tested your solution before merging the code but it triggered exceptions in PSv2 whenever it tried to access the UserId attribute of a Group Principal (whereas it was just fine in PSv5). Therefore I had to implement your solution slightly differently. I tested the code in PSv5 and PSv2, I get the exact same result now without any errors.
Thanks again for your contribution. It is very much appreciated.
May I ask you to check if this new version works for you too?
from privesccheck.
It's working the same on both versions for me too now, great, thanks for taking this into account ! I'm closing the PR.
I do have one interrogation though. When translating from member enumeration to Select-Object -ExpandProperty
I aimed to emulate the same behaviour as upstream without causing regressions. But what is the behaviour of upstream when multiple <Exec>
actions are defined in the scheduled tasks? Or multiple <Principal>
? Is it even possible, should we even worry about this? I don't know enough about Windows Scheduled Tasks to say if it is.
I welcome your input on this 🙂
from privesccheck.
Related Issues (20)
- Get-ModifiablePath false positive result processing deny only SID HOT 9
- Helper script detected by AMSI when building HOT 1
- Wifi Airstrike Attack (CVE-2021-28316) already mitigated Apr 13, 2021 HOT 2
- Cannot find process with ID for UDP Endpoints HOT 2
- Specified cast is not valid HOT 9
- Windows 11 detected as Windows 10 HOT 3
- Scheduled Task: Binary Exploitation no detection HOT 2
- Empty WinLogon credentials HOT 1
- Check for vulnerable WPAD configuration? HOT 2
- Report Improvement Suggestion HOT 2
- [Improvement] Check for vulnerable drivers HOT 1
- SERVICES > Unquoted Path not work as expected HOT 3
- Credential Guard HOT 3
- [Feature Request] Readd Compliance Field HOT 4
- Getting erros when trying to run it HOT 2
- Get-HotFixList misses updates HOT 2
- LapsV2 is not being checked? HOT 3
- Check SMB signing required HOT 5
- Service binary permissions false positive HOT 1
- List ASR rules HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from privesccheck.