GhostPack / Seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
Other
3.74k stars 685 forks source link

Scheduled Task File Permissions Audit module #126

Open lampnout opened 8 months ago

lampnout commented 8 months ago

This PR is opened to add the module "ScheduledTasksAudit" (implemented in ScheduledTasksAuditCommand.cs) on Seatbelt.

The module is hunting for privilege escalation vectors in scheduled tasks by investigating the permissions of the files each action runs.

In summary, the following logic has been implemented: